CVE-2024-10914: D-Link NAS command injection on end-of-life devices D-Link won't patch
The short version: Several end-of-life D-Link NAS models (DNS-320, DNS-320LW, DNS-325, DNS-340L) have an OS command-injection flaw (CVE-2024-10914) in the cgi_user_add account-management function. D-Link has stated it will not patch these retired devices — the only durable fix is to replace them. It's being scanned for in the wild, though it is not in CISA's KEV catalog. If you run one of these on the internet, retire it. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — no patch exists; the device must be replaced |
| CVSS v3.1 (NVD) | 9.8 — Critical (primary) · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · a secondary 8.1 metric rates attack complexity higher |
| EPSS | 97.43% · 99.89th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not listed in CISA KEV; widespread internet scanning has been reported |
| Vulnerability type | CWE-78 OS command injection → arbitrary command execution |
| Requires authenticated session? | No — reachable via the unauthenticated account-management endpoint |
| Affected | D-Link DNS-320, DNS-320LW, DNS-325, DNS-340L (firmware up to 20241028) — all end-of-life |
| Fixed in | No fix — end-of-life. D-Link recommends retiring/replacing the devices |
What you need to know
CVE-2024-10914 is an OS command injection in the cgi_user_add function reached via /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The name parameter is passed into a shell command without proper sanitization, so a crafted value injects attacker-controlled OS commands that the NAS then runs.
What makes this one different from a routine "patch it" story:
- There is no patch. These NAS models are past end-of-life, and D-Link has publicly declined to fix them — the guidance is to replace the hardware.
- NAS boxes hold data and often face the internet. They're commonly exposed for remote access and store exactly what an attacker wants.
- It's being probed at scale. Public exploit details exist and mass scanning has been reported — though, as of this writing, it is not in CISA KEV.
Note the two CVSS metrics: NVD's primary score is 9.8, while a secondary analysis rates the attack complexity higher (8.1). Either way, the practical problem is the same — an unfixable device you shouldn't leave exposed.
How serious we see it
Critical — driven less by the exact base score than by the fact that you cannot patch your way out.
Ordinarily unauthenticated command injection with a 9.8 is a clear Critical. We frame this as High-and-act-now because the remediation isn't a version bump — it's decommissioning hardware, which takes planning. Left on the internet, an affected NAS is a standing foothold; taken offline or replaced, the exposure is gone entirely. The path is clear even if it isn't a patch.
Recommendations
Straight from D-Link's end-of-life guidance:
- Retire or replace the device. These models are end-of-life with no fix — migrate off them.
- Get it off the internet immediately. If you can't replace it today, remove all inbound exposure; restrict access to a trusted local network only.
- Hunt if it was exposed. Assume compromise for any internet-facing unit — inspect for unexpected accounts, files, and outbound connections, and preserve/rotate any data and credentials it held.
- Confirm your exposure first. Verify whether any affected D-Link NAS model is reachable from the internet.
How BreachRisk sees it
BreachRisk discovers internet-facing D-Link NAS interfaces from little more than your domain and fingerprints the model, flagging exposure tied to this CVE. For a device-and-version flaw like this we detect and flag the exposure; we don't exploit it. That outside-in view is especially valuable for end-of-life gear, which tends to be exactly the forgotten, unmanaged hardware that never shows up in an asset list until it's someone's way in.