Email From Command Injection Remote Code Execution Vulnerability

CVE-2023-44422

Summary

The D-Link DIR-X3260 router is vulnerable to a command injection flaw that allows network-adjacent attackers to execute arbitrary code. This vulnerability is associated with the prog.cgi program, which processes HNAP requests on the lighttpd webserver operating on TCP ports 80 and 443. The issue arises from inadequate validation of a user-supplied string within the execution of a system call, creating a pathway for attackers to bypass authentication mechanisms and gain root access. This vulnerability represents a significant risk to network security, as it can be exploited by unauthorized individuals to compromise the affected routers.

References