# CASCA evidence receipt — CVE-2024-3273 - Generation: `gen-409cbd0c74ff4feb70e4944e6b98ce40` - As known: 2026-07-21T08:13:17.697275+00:00 - Comparison: gen-56ccdaf914f7b4be95b689ccae7dc20d - Score policy: public-priority-v1.0.1 - Conflict: present ## Source assertions - **CISA-ADP** (independent_enrichment): container — CISA ADP Vulnrichment - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2024-3273 - **CVE** (derivative_copy): container — CVE Program Container - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2024-3273 - **VulDB** (original_assertion): container — D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2024-3273 - **CISA KEV** (original_assertion): observed_exploitation — D-Link Multiple NAS Devices Command Injection Vulnerability - Observed: 2026-07-19T04:54:04.25158+00:00 - Citation: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - **FIRST EPSS** (original_assertion): model_probability — Probability 0.999970000000; percentile 0.999880000000 - Observed: 2026-07-19T04:54:35.756809+00:00 - Citation: https://www.first.org/epss/data_stats.html ## CVSS assessments - **nvd@nist.gov** (Primary, CVSS 3.1): 9.8 — score eligible - Evidence class: nvd_enrichment_exact; source rank: 0 - Validation: valid_match - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` - **cna@vuldb.com** (Secondary, CVSS 3.1): 7.3 — score eligible - Evidence class: exact_record_cna; source rank: 1 - Validation: valid_match - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L` - **cna@vuldb.com** (Secondary, CVSS 2.0): 7.5 — score eligible - Evidence class: exact_record_cna; source rank: 1 - Validation: valid_match - Vector: `AV:N/AC:L/Au:N/C:P/I:P/A:P` - **VulDB** (unknown, CVSS 3.1): 7.3 — display only - Evidence class: direct_cve_record_display_only; source rank: not applicable - Validation: display-only direct record assessment - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L` - **VulDB** (unknown, CVSS 3.0): 7.3 — display only - Evidence class: direct_cve_record_display_only; source rank: not applicable - Validation: display-only direct record assessment - Vector: `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L` - **VulDB** (unknown, CVSS 2.0): 7.5 — display only - Evidence class: direct_cve_record_display_only; source rank: not applicable - Validation: display-only direct record assessment - Vector: `AV:N/AC:L/Au:N/C:P/I:P/A:P` ## Applicability scope - **dlink · dns-320l_firmware** (direct_source; unknown) - Versions: [{"status": "affected", "version": "20240403"}] - **dlink · dns-325_firmware** (direct_source; unknown) - Versions: [{"status": "affected", "version": "20240403"}] - **dlink · dns-327l_firmware** (direct_source; unknown) - Versions: [{"status": "affected", "version": "20240403"}] - **dlink · dns-340l_firmware** (direct_source; unknown) - Versions: [{"status": "affected", "version": "20240403"}] - **D-Link · DNS-320L** (direct_source; unknown) - Versions: [{"status": "affected", "version": "20240403"}] - **D-Link · DNS-325** (direct_source; unknown) - Versions: [{"status": "affected", "version": "20240403"}] - **D-Link · DNS-327L** (direct_source; unknown) - Versions: [{"status": "affected", "version": "20240403"}] - **D-Link · DNS-340L** (direct_source; unknown) - Versions: [{"status": "affected", "version": "20240403"}] - **dlink · dnr-202l** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-1f2d28dc79457a61020d1282a33654c83393ea01b5359b20106df8b37f647ffe` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*` - **dlink · dnr-202l_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-4afbe0ecb50d9e25f18337ba1e86fb0b399963ca6a1d4cfffa7a888702b95699` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dnr-202l_firmware:-:*:*:*:*:*:*:*` - **dlink · dnr-322l** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-298b45eeaa0e7d5d77d4bf525678dda3ca001fc046924ffd2fa8ebe8b372a658` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*` - **dlink · dnr-322l_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-72ac30f87fad49664ddd6a732e12db4db271db8f66a6c5aae12f0c93e40d15ed` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dnr-322l_firmware:-:*:*:*:*:*:*:*` - **dlink · dnr-326** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-731f2f79a2f55f5c6941ea903118d811df8ad14c57dae6236e4fc704a08ab579` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*` - **dlink · dnr-326_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-2cd1b0bc16e962acda07f9de65a898f64e529447be8ebf8ef0aa30cf760f9e58` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dnr-326_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-1100-4** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-7d2ebfa18105c9c85343fc18282e44ed4716ccb0cff7cd5dc60af1cdc5ac1351` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*` - **dlink · dns-1100-4_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-65ec0d7a8fc3b2a80e4bfd78af05e1fcb4347f6ee4274ad5fb5f46a2e3bc7da5` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-1100-4_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-120** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-4305427664080d0b074f496db9a463cd2c7200d636b5438c38ff91ea57228e4d` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*` - **dlink · dns-1200-05** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-5b1866efdc80d460a7758b147d777d70bec5af5bddd023487a44a3dd8f32866d` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*` - **dlink · dns-1200-05_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-d6c7365f643878e816b612aff5c3a2d08a44b28ea6cbd93250893666c9d77cfe` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-1200-05_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-120_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-5e1c36f74a372332d120c1e07a1eabc1e19866596d287f3177b39ec858bc4f94` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-120_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-1550-04** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-a2abe058caa29f8397679e2b54c1fa7949b5ff749b509b06fa79b60384becd87` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*` - **dlink · dns-1550-04_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-41e1240fd68d4971375c0cbe40cc5cea98ea0f26b12b9f0074384fc2486fb497` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-1550-04_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-315l** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-f02e095716993241049f623bd9186c083c35928ce83f38f99bb79fe5e939d6fd` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*` - **dlink · dns-315l_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-c6002d499cdb079d0afe3a05e86ba5f4c1424a52772dd054fada979f3972c3d4` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-315l_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-320** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-032bf35b0702076d3527509152844313c909a952b613b9fa411413322ceb287f` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*` - **dlink · dns-320_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-0d2c8ca2631ada4e1d3a0d495ec5bf8c7dfef16b04b262cd052b7a237e7bf83a` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-320_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-320l** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-4a7140e909a2982940e956bc67efe921d7355121d2ff883a8606eda454e6d6e2` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*` - **dlink · dns-320l_firmware** (vulnerable_target; supported) - Versions: Version 1.01.0702.2013; Version 1.03.0904.2013; Version 1.11 - Canonical identity: `product-18bc6517c027f55a0ab58ecb714852556bd49db8db24ada79fa06e795bdb3a88` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-320l_firmware:1.01.0702.2013:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-320l_firmware:1.03.0904.2013:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-320l_firmware:1.11:*:*:*:*:*:*:*` - **dlink · dns-320lw** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-22f98243ac588bb60fe85c33a0467407f4fd7baeb1990523c7dd24fdc72400d4` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*` - **dlink · dns-320lw_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-f9058a52bd3ad130025083992bcf729a1c7c43124511286dc804a392f26a6472` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-320lw_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-321** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-e1b43d25d7d03aa4e6c281e20ea0e6822f9284e6aa6dea077a123dd81bcd442d` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*` - **dlink · dns-321_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-462f125bea0fa1878817c42621945982f9f656839179724029cf6670fc3a948a` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-321_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-323** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-654ddcb81d553d6211787aabdb12a68d96f693b9815ae40495567ad2159edb9d` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*` - **dlink · dns-323_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-64416f74db69ea5f204c52ae33992254c6d43cd5f9430a8121169df300a8800d` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-323_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-325** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-fd794abdc2506c408dc34b3daffd4a8121e546eed3ca13216cf42eb02b206204` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*` - **dlink · dns-325_firmware** (vulnerable_target; supported) - Versions: Version 1.01 - Canonical identity: `product-585e29e1849c48021bd72a6c8813612fd0a6615a37ed136861b8aede670a0ab8` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-325_firmware:1.01:*:*:*:*:*:*:*` - **dlink · dns-326** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-d8381f4dce8a203f1295ceb59df5d09b4d856deddf357c001ef7d6926a15523d` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*` - **dlink · dns-326_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-ab4761d4b96a531b7a5a8c375fb3223ae7e2fa2ff1f8be02cf610673bf48f59d` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-326_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-327l** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-e5dddd3673379179ed8487f285942c12ffb69984b81d8a27e3fdfbec8c610652` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*` - **dlink · dns-327l_firmware** (vulnerable_target; supported) - Versions: Version 1.00.0409.2013; Version 1.09 - Canonical identity: `product-469c08dfbe912166c8c05dc0030a96f5c6c3519ec5a04a9aa6b566459e07620a` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-327l_firmware:1.09:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-327l_firmware:1.00.0409.2013:*:*:*:*:*:*:*` - **dlink · dns-340l** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-51a1dc82149123d8bac98f24155fc395cf29ba0b3569678027237c056f047e96` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*` - **dlink · dns-340l_firmware** (vulnerable_target; supported) - Versions: Version 1.08 - Canonical identity: `product-5a58692576b0665d29ed694ba102dc0345c2fe43257f9136678fc6706260b68c` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-340l_firmware:1.08:*:*:*:*:*:*:*` - **dlink · dns-343** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-f8fb76e026e0b54cc81fc0098042e4e783487a498ac2de50cac2cc90d5285f55` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*` - **dlink · dns-343_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-fe1b6cf88871f2bb6a8a78b3b6b5b8bfe81df08a99a0db26653975d879b998cc` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-343_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-345** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-64933d422ec2a196a1fadbede4ba0113b42553a5dc6af9bbf34b6ed60a7bdcc8` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*` - **dlink · dns-345_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-34039679fa60b9c16335c44c1b667efdc46a56758e84796fe84ddeb5797ab31c` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-345_firmware:-:*:*:*:*:*:*:*` - **dlink · dns-726-4** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-451dcf95b4ce5b771412bcb8dd346dc339543ba3f275621693fcb71171fb8f80` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*` - **dlink · dns-726-4_firmware** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-07390a8e1ee733a732dacc129310f774032ca4f62d31e1fa919efc6fc8c97196` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:dlink:dns-726-4_firmware:-:*:*:*:*:*:*:*` ## Identity source boundaries - **cpe_dictionary**: 1775266 records through 2026-07-21T06:45:29.809553+00:00 - Run: `27d65b0f-b718-4b4f-bb79-c47c68d09dfa` - **cpe_match**: 643502 records through 2026-07-21T08:13:17.697275+00:00 - Run: `955dae73-7302-438b-aee1-058d7cc5d48e` ## Limitations and unknowns - KEV membership is authoritative for the catalog, not proof of exposure in any environment. - EPSS is a dated model probability and not an individual-environment prediction. - Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown. - NVD-carried upstream facts remain derivative and are not independent corroboration. - Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only. - NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only. - Factor D remains unknown because WC-03 has not converted canonical CPE mappings into generation-bound mapping obligations; canonical identity alone does not score applicability. - Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred. Generated from CASCA normalized evidence. This receipt is not proof that an asset is affected, unaffected, safe, or fixed.