D-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection Remote Code Execution Vulnerability
CVE-2023-44426

8HIGH

Key Information:

Vendor
D-link
Status
Dir-x3260
Vendor
CVE Published:
3 May 2024

Summary

The issue in D-Link DIR-X3260 routers arises from improper validation in the prog.cgi file, which processes HNAP requests. Attackers positioned on the same network can exploit this insufficient validation, enabling them to execute arbitrary code with root privileges. The vulnerability is particularly concerning since it allows for the bypassing of the existing authentication mechanisms, thereby increasing the risk of unauthorized access to sensitive system functions.

Affected Version(s)

DIR-X3260 1.02B02

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1524/
x_research-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.