EmailTo Command Injection Remote Code Execution Vulnerability
CVE-2023-44424

8HIGH

Key Information:

Vendor
D-link
Status
Dir-x3260
Vendor
CVE Published:
3 May 2024

Summary

The vulnerability in D-Link DIR-X3260 routers arises from command injection vulnerabilities within the SetSysEmailSettings functionality in prog.cgi. This flaw allows network-adjacent attackers with authentication privileges to execute arbitrary code, as the router fails to adequately validate user-supplied input before execution. The vulnerability can be exploited despite existing authentication controls, posing significant risks for users. The affected webserver, lighttpd, listens on TCP ports 80 and 443, enabling potential foundational breaches that compromise router integrity.

Affected Version(s)

DIR-X3260 1.02B02

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1522/
x_research-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.