[textfile]

Threat actors are actively scanning and exploiting a pair of security flaws that are said to affect as many as 92,000 internet-exposed D-Link network-attached storage (NAS) devices.

Tracked as CVE-2024-3272 (CVSS score: 9.8) and CVE-2024-3273 (CVSS score: 7.3), the vulnerabilities impact legacy D-Link products that have reached end-of-life (EoL) status. D-Link, in an advisory, said it does not plan to ship a patch and instead urges customers to replace them.

The findings once again illustrate that Mirai botnets are continuously adapting and incorporating new vulnerabilities into their repertoire, with threat actors swiftly developing new variants that are designed to abuse these issues to breach as many devices as possible.

[AFS_Nemesis]

So D-Link encrypting their binaries didn't help much after all?

[Dev]

So D-Link encrypting their binaries didn't help much after all?

https://github.com/ThatNotEasy/CVE-2024-3273

To my knowledge, its as easy as

/cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system={encoded_command}

Although, i haven't personally scanned so I'm not sure.

[dense]

Looks like a simple PoC
92k EoL public facing instances seems like a lot

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[AFS_Nemesis]

So D-Link encrypting their binaries didn't help much after all?

https://github.com/ThatNotEasy/CVE-2024-3273

To my knowledge, its as easy as

/cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system={encoded_command}

Although, i haven't personally scanned so I'm not sure.

I was talking about how they encrypt their firmware. Considering the exploit, it's super simple.

I'm looking into a backdoor on another manufacturer. It's a sha3 with salt but commented out, no username, admin role. I'm going through all their other binaries looking for where it may have been left in... I suspect it's a relic of the development process. Silly developers...

[Dev]

So D-Link encrypting their binaries didn't help much after all?

https://github.com/ThatNotEasy/CVE-2024-3273

To my knowledge, its as easy as

/cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system={encoded_command}

Although, i haven't personally scanned so I'm not sure.

I was talking about how they encrypt their firmware. Considering the exploit, it's super simple.

I'm looking into a backdoor on another manufacturer. It's a sha3 with salt but commented out, no username, admin role. I'm going through all their other binaries looking for where it may have been left in... I suspect it's a relic of the development process. Silly developers...

Ahh my bad I understand now. And amazing! If you get bored, need some alternative insight/a different perspective, message me! And just a bit.