LastPatch
EN

Is the D-Link DNS-320 still getting security updates?

The D-Link DNS-320 stopped receiving security updates on 1 December 2018. New vulnerabilities will not be fixed.

The date after which a device gets no more security fixes is also called its end of life (EOL) or end of support.

No longer supported

Security updates ended on

1 December 2018
Device
D-Link DNS-320 (NAS)
Basis
Official end date published by the manufacturer.
As written
12/1/2018
Source
D-Link | Legacy Products (Model / Last Day of Support) (United States)

What to do. Attackers are using known flaws in this model. Replace it. Until then, turn off remote administration and UPnP, and keep it off the Internet.

Vulnerabilities attackers are using

The U.S. cybersecurity agency (CISA) lists these vulnerabilities as actively exploited. Its description names the affected hardware versions when they are known.

  • CVE-2019-16057 (used in ransomware campaigns): The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
  • CVE-2020-25506: D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.

Support timeline

201720192021202320252027All versionsToday
Security updates per hardware version, to scale. The bar ends on the manufacturer's date.

Questions

Is the D-Link DNS-320 still getting security updates?

The D-Link DNS-320 stopped receiving security updates on 1 December 2018. New vulnerabilities will not be fixed.

Is the D-Link DNS-320 affected by vulnerabilities attackers are using?

Yes. The CISA catalogue of exploited vulnerabilities lists CVE-2019-16057, CVE-2020-25506 for this model. Check the affected hardware versions and install the latest firmware, or replace the device if it is no longer supported.

What does end of life mean for the D-Link DNS-320?

After its end of life, the D-Link DNS-320 receives no more security fixes from D-Link. It keeps working, but any vulnerability found later stays open, which makes it an easy target once attackers know about it.

Where does this date come from?

From the manufacturer: D-Link | Legacy Products (Model / Last Day of Support). Each date is shown exactly as published.

  • DNS-120ended 1 January 2009 Unsupported
  • DNS-315Lended 11 September 2014 Unsupported
  • DNS-320Lended 31 May 2020 Unsupported
  • DNS-320LWended 31 May 2020 Unsupported
  • DNS-321ended 5 May 2013 Unsupported
  • DNS-323ended 5 May 2013 Unsupported
  • DNS-325ended 1 September 2017 Unsupported
  • DNS-326ended 30 June 2013 Unsupported
  • DNS-327Lended 31 May 2020 Unsupported
  • DNS-340Lended 31 July 2019 Unsupported
  • DNS-343ended 28 February 2020 Unsupported
  • DNS-345ended 1 February 2019 Unsupported

Every D-Link device   NAS drives from every brand