D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability
CVE-2023-44425

8HIGH

Key Information:

Vendor
D-link
Status
Dir-x3260
Vendor
CVE Published:
3 May 2024

Summary

A security vulnerability exists in the D-Link DIR-X3260 routers that allows for remote code execution through a command injection flaw. This vulnerability is exploitative even with authentication, as attackers are able to bypass the existing authentication mechanism. The flaw specifically impacts the prog.cgi component, which manages HNAP requests via the lighttpd web server on TCP ports 80 and 443. The lack of adequate validation on a user-supplied input string enables an attacker to execute arbitrary code with root privileges, leading to potential unauthorized access and control of the device.

Affected Version(s)

DIR-X3260 1.02B02

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1523/
x_research-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.