A few days after D-Link informed customers that it will not patch a vulnerability found recently in some of its legacy network-attached storage (NAS) devices, the Shadowserver Foundation started seeing in-the-wild exploitation attempts aimed at the flaw.

The vulnerability, tracked as CVE-2024-10914, has been described as a command injection issue that allows an unauthenticated, remote attacker to inject arbitrary shell commands via specially crafted HTTP GET requests.

NetSecFish last week disclosed the details of the vulnerability and noted that there had been over 61,000 internet-exposed D-Link NAS devices. 

D-Link has identified 20 impacted DNS series NAS models and urged their owners to replace the devices as they have reached end of life (EOL) and they will not receive security patches for CVE-2024-10914. 

D-Link published an advisory on November 8 and the Shadowserver Foundation started seeing exploitation attempts targeting CVE-2024-10914 on November 12. 

The non-profit cybersecurity organization has seen roughly 1,100 internet-exposed devices that could be vulnerable to attacks, a majority located in Europe.  

It’s not uncommon for threat actors to target D-Link NAS device vulnerabilities. Earlier this year, a different D-Link NAS product vulnerability disclosed by NetSecFish was exploited in attacks just days after its disclosure. 

D-Link router vulnerabilities have also been targeted by threat groups in recent years. 

Related: Critical Zimbra Vulnerability Exploited One Day After PoC Release

Related: D-Link Warns of Code Execution Flaws in Discontinued Router Model

Related: Recent Zyxel NAS Vulnerability Exploited by Botnet