D-Link says it won’t fix a serious security flaw affecting 60,000 older NAS devices
- A critical vulnerability has been found in multiple D-Link models
- Because the devices have reached the end of their lifespan, they are not patched
- Solutions are available, although users are advised to replace the devices
D-Link says it will not fix a critical vulnerability affecting tens of thousands of network attached storage (NAS) devices because they have reached end of life.
Recently, a vulnerability with a severity score of 9.2 (critical) was found in multiple models of D-Link NAS devices. Tracked as CVE-2024-10914, it was described as a command injection exploit that allows threat actors to inject arbitrary shell commands. By sending a specially crafted HTTP GET request to the device, the scammers can remotely cause significant system damage.
While the researchers say the exploitation is somewhat difficult because the complexity of an attack is relatively high, they do emphasize that a publicly available exploit exists.
Alleviate the problem
In total, there are more than 60,000 endpoints that could be compromised via this flaw, it further explained. That includes several models, such as:
DNS-320 version 1.00
DNS-320LW version 1.01.0914.2012
DNS-325 version 1.01, version 1.02
DNS-340L version 1.08
Most of these appear to be used by small and medium-sized businesses, it added.
In the absence of a patch, D-Link advises users to retire the old devices and replace them with newer, supported models. For those who are currently unable to do so, it is advised to isolate the endpoints from the public internet and place them under stricter access conditions.
A NAS device is a dedicated data storage unit connected to a network, allowing multiple users and devices to centrally access and store data. It offers secure file sharing, data backup and storage, making it ideal for both home and business use. NAS devices are typically easy to set up and scale and offer RAID support and other data loss protection.
Cybercriminals often target NAS devices because they often contain sensitive data, including personal documents, financial information and business files. By compromising NAS systems, attackers can steal, encrypt or delete valuable data, with ransomware being a common threat.
Via BleepingComputer
