CVE-2024-3272: D-Link Network Attached Storage - Backdoor Account
HoneyLabs honeypots recorded 188 probes matching CVE-2024-3272 from 7 distinct source IP addresses in the last 7 days, of which 187 on interactive sensors. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2024-04-11.
6 sources probed for CVE-2024-3272 on the interactive sensors, and all of them sent the exploit payload. One of them is a recognised scanner.
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-02, with 36. One address, 94.183.174.99, sent 91% of them. The largest source network was AS51396 (Pfcloud UG (haftungsbeschrankt)), with 91% of the probes from 1 address. It is still being probed 2 years after CISA added it to the Known Exploited Vulnerabilities list.
Request paths that identify it
- /cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=aWQ=
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 94.183.174.99 | 171 | Pfcloud UG (haftungsbeschrankt) | United Arab Emirates |
| 155.254.108.100 | 8 | Akari Networks | Singapore |
| 165.154.11.140 | 4 | UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED · recognised scanner: Quake | Nigeria |
| 155.254.126.34 | 2 | Akari Networks | United States |
| 31.57.243.169 | 1 | Latitude.sh LTDA | United States |
| 66.92.21.200 | 1 | Psychz Networks | United States |
| 82.57.30.237 | 1 | TIM | Italy |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS51396 | Pfcloud UG (haftungsbeschrankt) | 171 | 1 |
| AS38136 | Akari Networks | 10 | 2 |
| AS135377 | UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | 4 | 1 |
| AS262287 | Latitude.sh LTDA | 1 | 1 |
| AS3269 | TIM | 1 | 1 |
| AS40676 | Psychz Networks | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| United Arab Emirates | 171 |
| Singapore | 8 |
| Nigeria | 4 |
| United States | 4 |
| Italy | 1 |
Captured requests
- /cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=aWQ=
Requests the interactive sensors answered
- GET /cgi-bin/nas_sharing.cgi
HTTP client fingerprints
- b11cun010_00040000_c4b2c4aa
- b11cun030_00040011_c91eaf54
- b11cun050_00040017_976354f0
- b11cun050_00040017_97f1d74f
CVE report
Open a specific CVE from the CVE tracker.