Critical 9.8
KEV-listed
CVE-2024-3272
Proxyjacking Campaign Exploiting Vulnerabilities in D-Link, Ubiquiti, and SAP Edge Devices
Vendor / product: D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, SAP NetWeaver Visual Composer
Public PoC: Yes
First tracked by RiskWire: 2026-10-17
CISA KEV catalog
Added to KEV
Federal remediation due
2024-05-02 (898 days overdue)
Ransomware campaign use
Unknown
CISA description
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
Required action
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Named threat actors
skynox7
Sources & citations (3)
- Proxyjacking campaign exploits vulnerabilities to monetize internet connections scworld.com · 2026-10-16
- Proxyjacking: Παγκόσμια επίθεση σε συσκευές D-Link iguru.gr · 2026-10-16
- Proxyjacking campaign turns exposed edge devices into resale bandwidth nodes news-pravda.com · 2026-10-16
References
See CVE-2024-3272 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →