CVE-2024-3272: Hard‑Coded Credentials in D‑Link NAS Devices Enable Remote Code Execution
What It Is — D‑Link’s DNS‑320L, DNS‑325, DNS‑327L and DNS‑340L network‑attached storage appliances embed a static administrative password. An attacker who can reach the device’s web interface can authenticate with this credential and inject arbitrary commands, achieving remote code execution.
Exploitability — The vulnerability is publicly disclosed, proof‑of‑concept code is available, and no additional authentication beyond network access is required. CVSS is rated 8.8 (High). No widespread exploitation has been reported yet.
Affected Products — D‑Link DNS‑320L, DNS‑325, DNS‑327L, DNS‑340L (all firmware versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Demonstrates a control gap in credential management; hard‑coded secrets violate the principle of least privilege and impede continuous assurance of access controls.
- Remediation provides audit‑ready evidence that privileged accounts are being rotated, documented, and monitored—key for a defensible control posture.
- Highlights the necessity of integrating vendor advisories into a continuous monitoring pipeline to maintain an up‑to‑date evidence trail for compliance reviews.
Recommended Actions
- Inventory every D‑Link NAS device and verify firmware version; apply D‑Link’s security patch immediately.
- Disable default accounts or replace the hard‑coded password with a unique, strong secret; enable MFA where possible.
- Add the devices to automated vulnerability scanning and control‑evidence collection processes.
- Record the remediation steps in your access‑control policy and retain the documentation for audit readiness.
Source: CISA KEV – CVE‑2024‑3272