EmailTo Command Injection Remote Code Execution Vulnerability
CVE-2023-44424

8HIGH

Key Information:

Vendor

D-link
Status
Dir-x3260
Vendor
CVE Published:
3 May 2024

What is CVE-2023-44424?

The vulnerability in D-Link DIR-X3260 routers arises from command injection vulnerabilities within the SetSysEmailSettings functionality in prog.cgi. This flaw allows network-adjacent attackers with authentication privileges to execute arbitrary code, as the router fails to adequately validate user-supplied input before execution. The vulnerability can be exploited despite existing authentication controls, posing significant risks for users. The affected webserver, lighttpd, listens on TCP ports 80 and 443, enabling potential foundational breaches that compromise router integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

DIR-X3260 1.02B02

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1522/
x_research-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.