CVE-2024-3273: D-Link NAS RCE Exploited in the Wild | Grey Noise Blog
Summary: A remote code execution vulnerability in D-Link NAS devices, tracked as CVE-2024-3273, is being actively exploited and was initially believed to affect as many as 92,000 devices, though Censys puts the number closer to 5,500. Exploitation requires valid user= and passwd= parameters, and the flaw is that the empty password for the pre-configured 'messagebus' system user is never checked against whether that user should be able to log in with a password at all.
What's compelling: GreyNoise observed the exploit fetching malware from 38[.]6[.]224[.]248 over HTTP using a generic shell script that tries every CPU architecture in turn, so any unpatched D-Link NAS still reachable is a candidate for the same botnet recruitment.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-3272CVE-2024-3273
- Related
- CVE-2024-3272: D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability Known Exploited Vulnerabilities · Apr 11, 2024CVE-2024-3273: D-Link Multiple NAS Devices Command Injection Vulnerability Known Exploited Vulnerabilities · Apr 11, 2024