Critical D-Link NAS vulnerability under active exploitation

**Executive Summary:** Cyble observed active exploitation of two vulnerabilities in D-Link NAS devices (CVE-2024-3272: hard-coded credentials; CVE-2024-3273: command injection) with public exploit disclosure and forum-sharing; the CGSI network detected exploitation attempts since April 9 and identified many internet-exposed devices (~94,446) and multiple IP IOCs attributed to attackers predominantly originating from China.