D-Link says it won’t fix a serious security flaw affecting 60,000 older NAS devices

• A critical vulnerability has been found in multiple D-Link models
• Since the devices have reached end-of-life status, they won’t be patched
• Mitigations are available, although users are advised to replace the devices

D-Link says it won’t fix a critical vulnerability plaguing tens of thousands of network-attached storage (NAS) devices because they have reached their end of life.

Recently, a vulnerability with a 9.2 severity score (critical) was found in multiple models of D-Link NAS devices. Tracked as CVE-2024-10914 it was described as a command injection exploit that allows threat actors to inject arbitrary shell commands. By sending a specially crafted HTTP GET request to the device, the crooks could cause significant system compromise, remotely.

While the researchers say the exploitation is somewhat difficult since the complexity of an attack is relatively high, they did stress that there is a publicly available exploit out there.

Mitigating the problem

In total, there are more than 60,000 endpoints out there that could be compromised via this flaw, it was further explained. That includes multiple models, such as:

DNS-320 Version 1.00
DNS-320LW Version 1.01.0914.2012
DNS-325 Version 1.01, Version 1.02
DNS-340L Version 1.08

Most of these seem to be used by small and medium-sized businesses, it was added.

Since there will be no patch, D-Link advises users to retire the old devices and replace them with newer, supported models. For those that cannot do that at the moment, it is advised to isolate the endpoints from the public internet and place them under stricter access conditions.

A NAS device is a dedicated data storage unit connected to a network, allowing multiple users and…