CVE-2024-10914

Think of this device’s account-management page like a door with a “create user” button. Because of a flaw, a skilled attacker might be able to trick that button into running system commands on the device instead of only creating a user. If they can reach the door from the network, the attacker could potentially take control of the device and disrupt service or access stored files.

This matters if you use D-Link DNS-320, DNS-320LW, DNS-325, or DNS-340L (including their firmware) for storing or serving business files and you expose the web management/account features to other networks. The risk is remote, meaning the attack can be launched over the network, but the exploit difficulty is described as high. Only treat it as an immediate risk if the device’s management interface is reachable from the internet (for example through port forwarding or remote access).

This is RED because the vulnerability has received sustained security attention and the public disclosure means attackers can act on it. While exploitation may be described as difficult, the impact (command injection leading to device compromise) is severe enough that you should treat it as urgent and patch/restrict access immediately.