| D-Link DNS-320L (DNS-320L)
|
|
Security Grade
Calculator v
|
ShareCenter DNS-320L 2-Bay Cloud Network Storage Enclosure
Category: NAS • Model / Gen: All hardware revisions; legacy product DNS-320L
Release Date: 2012-07-09 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Provisional assessment: removable drives, external ports and reset access create physical exposure; no independent resistance or incident frequency was measured.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
CVE-2024-3272 (hardcoded credentials) and CVE-2024-3273 (command injection) affect this end-of-life model. Rare denotes documented issues, not a quantitative prevalence measurement.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Singapore CSA reports active exploitation of the affected D-Link NAS family including DNS-320L. Rare is a qualitative frequency choice; actual incidence was not measured.
|
| Updatability
|
None
|
🔗 Proof
|
D-Link SAP10383 lists all hardware revisions as end of support, with US EOS 2020-05-31; no further security patches are provided and replacement is recommended.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Local users/groups and optional SSL login exist. Partial reflects legacy mixed services and the documented credential weakness; not every exposed interface has independently verified authentication.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
The legacy manual documents SSL login. Obsolete encryption is a conservative EOL-era inference: protocol/cipher versions on the installed firmware were not tested, and this is not a claim that every connection is encrypted.
|
| Storage
|
No encryption
|
🔗 Proof
|
Conservative provisional rating: disk/flash encryption at rest was not verified in the reviewed manual. Do not interpret missing evidence as a proven plaintext-storage finding; moderator review requested.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
The manual documents creating users and groups and assigning shared-folder permissions. Full applies to these NAS account-management functions, not MFA or patch status.
|
| Authentication
|
Basic
|
🔗 Proof
|
Password-based login exists, but the vendor documents hardcoded-credential exposure. Basic reflects this legacy authentication risk.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
Absent is a provisional conservative assumption for administrator login: no verified rate-limit/lockout evidence was established. It is not a measured proof that all brute-force controls are missing.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The manual documents system/activity logs. Partial does not assert complete security-event coverage, tamper resistance or centralized audit integrity.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
CVE-2024-3272 documents hardcoded credentials on affected EOL firmware. This rating concerns that documented historical vulnerability, even where an owner changed the normal admin password.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Desk-based assessment dated 2026-10-25; no exploitation or hands-on tests. Scope: DNS-320L, all revisions covered by SAP10383. Vendor recommends replacement because security updates have ended. Regional lifecycle dates can differ; 2020-05-31 is from the US notice.
Release date 2012-07-09 is the official product-announcement date, not a firmware date. Unverified properties are marked as provisional assumptions; no Unknown option is available in this form.
References:
