D-Link says it wont fix a serious security flaw affecting 60,000 older NAS devices

Date:
Mon, 11 Nov 2024 19:06:00 +0000

Description:
The company advises users replace affected endpoints with newer models.

FULL STORY ======================================================================A critical vulnerability has been found in multiple D-Link models Since the devices have reached end-of-life status, they won't be patched Mitigations
are available, although users are advised to replace the devices

D-Link says it wont fix a critical vulnerability plaguing tens of thousands
of network-attached storage ( NAS ) devices because they have reached their end of life.

Recently, a vulnerability with a 9.2 severity score (critical) was found in multiple models of D-Link NAS devices. Tracked as CVE-2024-10914 it was described as a command injection exploit that allows threat actors to inject arbitrary shell commands. By sending a specially crafted HTTP GET request to the device, the crooks could cause significant system compromise, remotely.

While the researchers say the exploitation is somewhat difficult since the complexity of an attack is relatively high, they did stress that there is a publicly available exploit out there. Mitigating the problem

In total, there are more than 60,000 endpoints out there that could be compromised via this flaw, it was further explained. That includes multiple models, such as:

DNS-320 Version 1.00
DNS-320LW Version 1.01.0914.2012
DNS-325 Version 1.01, Version 1.02
DNS-340L Version 1.08

Most of these seem to be used by small and medium-sized businesses, it was added.

Since there will be no patch, D-Link advises users to retire the old devices and replace them with newer, supported models. For those that cannot do that at the moment, it is advised to isolate the endpoints from the public
internet and place them under stricter access conditions.

A NAS device is a dedicated data storage unit connected to a network,
allowing multiple users and devices to access and store data centrally. It provides secure file sharing, data backup, and storage, making it ideal for both home and business use. NAS devices are typically easy to set up and scale, offering RAID support and other protections against data loss.

Cybercriminals frequently target NAS devices because they often hold
sensitive data, including personal documents, financial information, and business files. By compromising NAS systems, attackers can steal, encrypt, or delete valuable data, with ransomware being a common threat.

Via BleepingComputer You might also like Thousands of D-Link NAS devices
have serious backdoor security issues Here's a list of the best firewalls today These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/d-link-says-it-wont-fix-a-serious-secur ity-flaw-affecting-60-000-older-nas-devices


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)