Over 92,000 exposed D-Link NAS devices have a backdoor account

Malcontent · Apr 6, 2024

A threat researcher has disclosed a new arbitrary command injection and hardcoded backdoor flaw in multiple end-of-life D-Link Network Attached Storage (NAS) device models.

The two main issues contributing to the flaw, tracked as CVE-2024-3273, are a backdoor facilitated through a hardcoded account (username: "messagebus" and empty password) and a command injection problem via the "system" parameter.

When chained together, any attacker can remotely execute commands on the device.
Click to expand...

Over 92,000 exposed D-Link NAS devices have a backdoor account

Log in or Sign up

Over 92,000 exposed D-Link NAS devices have a backdoor account

Malcontent Registered Member

Log in or Sign up

Over 92,000 exposed D-Link NAS devices have a backdoor account

Malcontent Registered Member

Useful Searches