Search the Community

Cyber attacks have become increasingly prevalent. This has caused significant adverse impacts on businesses of all sizes. According to the latest Ponemon Institute’s State of Cybersecurity Report, 66% of respondents reported experiencing a cyber attack within the last 12 months. This underscores the critical need for robust cybersecurity measures. It is across various domains such […] The post Critical RCE Vulnerability in 92,000 D-Link NAS Devices appeared first on Kratikal Blogs. The post Critical RCE Vulnerability in 92,000 D-Link NAS Devices appeared first on Security Boulevard. View the full article

A high-severity vulnerability has been recently discovered in certain D-Link Network Attached Storage (NAS) instances which could be used to run malicious code, steal sensitive data, and mount denial-of-service (DoS) attacks. Cybersecurity researcher Netsecfish, who discovered the flaw, found multiple instances of D-Link’s NAS devices have an arbitrary command injection flaw in the “system” parameter, and a hardcoded account that can be used to access the device. As a result, hackers can run commands as they please: "Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access to sensitive information, modification of system configurations, or denial of service conditions," the researcher said. No patch The vulnerability is tracked as CVE-2024-3273. Apparently, there are roughly 92,000 of these D-Link NAS devices in use today, meaning that the attack surface is relatively large. Multiple models are affected, including: DNS-320L Version 1.11, Version 1.03.0904.2013, Version 1.01.0702.2013; DNS-325 Version 1.01; DNS-327L Version 1.09, Version 1.00.0409.2013; and DNS-340L Version 1.08. Unfortunately, the patch is not coming. These devices, D-Link confirmed to BleepingComputer, are way past their end of life, and as such will not be fixed. The company released a security bulletin, and urged its customers to replace the devices with newer versions as soon as possible. "All D-Link Network Attached storage has been End of Life and of Service Life for many years [and] the resources associated with these products have ceased their development and are no longer supported," the spokesperson told the publication. "D-Link recommends retiring these products and replacing them with products that receive firmware updates." Even those that receive firmware updates should never be exposed to the internet as cybercriminals see them as valuable targets. More from TechRadar Pro UK government releases new cloud SCADA security guidance for OTHere's a list of the best firewalls around todayThese are the best endpoint security tools right now View the full article