CVE-2024-3274 json
D-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosure
published 2024-04-04 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-31864
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 33.5%
- EPSS 33.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-320L, DNS-320LW and DNS-327L up to 20240403 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/info.cgi of the component HTTP GET Request Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259285 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
33.48% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure nuclei detection template
- github.com https://github.com/netsecfish/info_cgi referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- D-Link DNS-320L
- D-Link DNS-320LW
- D-Link DNS-327L
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/netsecfish/info_cgi
exploit
-
vuldb.com
/?id.259285
vdb-entry
-
vuldb.com
/?ctiid.259285
signature, permissions-required
-
vuldb.com
/?submit.304706
third-party-advisory
-
supportannouncement.us.dlink.com
/security/publication.aspx?name=SAP10383
related
Sources
- CVE List CVE-2024-3274
- NVD CVE-2024-3274
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.