D-Link DIR-X3260 prog.cgi SOAPAction Command Injection Remote Code Execution Vulnerability

CVE-2023-35723

What is CVE-2023-35723?

A security vulnerability has been identified in D-Link DIR-X3260 routers, allowing potential exploitation by network-adjacent attackers. This flaw is related to the handling of the SOAPAction request header in the prog.cgi endpoint, where insufficient validation of a user-supplied string can lead to arbitrary code execution. An attacker with knowledge of this vulnerability can execute commands in the context of root, posing significant risks for the affected installations. No authentication is required to exploit this issue, making it critical for users to address this vulnerability promptly.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References