What is the CVSS score of CVE-2024-3273?

CVE-2024-3273 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 100.0%.

Is there a public PoC exploit available for CVE-2024-3273?

Yes, a public proof-of-concept exploit is available for CVE-2024-3273. Prioritise patching immediately. EPSS: 100.0%.

Dns 320L Firmware CVE-2024-3273

CRITICAL

Command Injection (CWE-77)

2024-04-04 cna@vuldb.com

D-Link Command Injection Dns 320L Firmware Dns 120 Firmware Dnr 202L Firmware Dns 315L Firmware Dns 320 Firmware Dns 320Lw Firmware Dns 321 Firmware Dnr 322L Firmware Dns 323 Firmware Dns 325 Firmware Dns 326 Firmware Dns 327L Firmware Dnr 326 Firmware Dns 340L Firmware Dns 343 Firmware Dns 345 Firmware Dns 726 4 Firmware Dns 1100 4 Firmware Dns 1200 05 Firmware Dns 1550 04 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 14, 2026 - 04:22 CISA

CVE Published

Apr 04, 2024 - 01:15 nvd

CRITICAL 9.8

DescriptionNVD

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

AnalysisAI

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Affected products include: Dlink Dns-320L Firmware, Dlink Dns-120 Firmware, Dlink Dnr-202L Firmware, Dlink Dns-315L Firmware, Dlink Dns-320 Firmware. Version information: up to 20240403..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.