D-Link NAS devices have been affected by a critical vulnerability, impacts several D-Link NAS models, including DNS-320, DNS-320LW, DNS-325, and DNS-340L,
The vulnerability tracked as CVE-2024-10914, with a CVSSv4 score of 9.2, , a command injection vulnerability in the `account_mgr.cgi` script, allows remote attackers to execute arbitrary commands via specially crafted HTTP GET requests
The vulnerability specifically affects the `name` parameter within the `cgi_user_add` command of the `account_mgr.cgi` script. Due to inadequate input sanitization, malicious commands injected into the `name` parameter can lead to unauthorized command execution.
Affected Devices
- DNS-320 – Version 1.00
- DNS-320LW – Version 1.01.0914.2012
- DNS-325 – Versions 1.01 and 1.02
- DNS-340L – Version 1.08
An attacker can exploit the vulnerability by sending a specially crafted HTTP GET request to the NAS device’s IP address. This command injects a shell command into the `name` parameter, triggering unintended execution on the target device.
The following example demonstrates an exploit using the `curl` command:
curl “http://[Target-IP]/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27;<INJECTED_SHELL_COMMAND>;%27”
To remediate this vulnerability, it is recommended that:
- 1. Apply available patches and updates from the device manufacturer.
- 2. Users of the affected devices should apply the firmware update as soon as it is available.
- 3. As an interim measure, network access to the NAS management interface should be restricted to trusted IP addresses.
For more information, refer to the blog
