Sign-up

ID

VAR-202310-0115


CVE

CVE-2023-44421


TITLE

D-Link Systems, Inc.  of  dir-x3260  in the firmware  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2023-028869

DESCRIPTION

D-Link DIR-X3260 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21101. D-Link Systems, Inc. of dir-x3260 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The D-Link DIR-X3260 is a mainstream router from D-Link that supports Wi-Fi 6

Trust: 2.79

sources: NVD: CVE-2023-44421 // JVNDB: JVNDB-2023-028869 // ZDI: ZDI-23-1519 // CNVD: CNVD-2025-26819

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-26819

AFFECTED PRODUCTS

vendor:d linkmodel:dir-x3260scope: - version: -

Trust: 2.1

vendor:dlinkmodel:dir-x3260scope:ltversion:1.04b01

Trust: 1.0

vendor:d linkmodel:dir-x3260scope:eqversion:dir-x3260 firmware 1.04b01

Trust: 0.8

vendor:d linkmodel:dir-x3260scope:eqversion: -

Trust: 0.8

sources: ZDI: ZDI-23-1519 // CNVD: CNVD-2025-26819 // JVNDB: JVNDB-2023-028869 // NVD: CVE-2023-44421

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2023-44421
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2023-44421
value: HIGH

Trust: 1.0

NVD: CVE-2023-44421
value: HIGH

Trust: 0.8

ZDI: CVE-2023-44421
value: HIGH

Trust: 0.7

CNVD: CNVD-2025-26819
value: HIGH

Trust: 0.6

CNVD: CNVD-2025-26819
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2023-44421
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2023-44421
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2023-44421
baseSeverity: HIGH
baseScore: 8.0
vectorString: AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-1519 // CNVD: CNVD-2025-26819 // JVNDB: JVNDB-2023-028869 // NVD: CVE-2023-44421 // NVD: CVE-2023-44421

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

problemtype:OS Command injection (CWE-78) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-028869 // NVD: CVE-2023-44421

PATCH

title:Patch for D-Link DIR-X3260 Command Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/748851

Trust: 0.6

sources: CNVD: CNVD-2025-26819

EXTERNAL IDS

db:NVDid:CVE-2023-44421

Trust: 3.9

db:ZDIid:ZDI-23-1519

Trust: 3.1

db:JVNDBid:JVNDB-2023-028869

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-21101

Trust: 0.7

db:CNVDid:CNVD-2025-26819

Trust: 0.6

sources: ZDI: ZDI-23-1519 // CNVD: CNVD-2025-26819 // JVNDB: JVNDB-2023-028869 // NVD: CVE-2023-44421

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-23-1519/

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2023-44421

Trust: 0.8

sources: CNVD: CNVD-2025-26819 // JVNDB: JVNDB-2023-028869 // NVD: CVE-2023-44421

CREDITS

Nicholas Zubrisky

Trust: 0.7

sources: ZDI: ZDI-23-1519

SOURCES

db:ZDIid:ZDI-23-1519
db:CNVDid:CNVD-2025-26819
db:JVNDBid:JVNDB-2023-028869
db:NVDid:CVE-2023-44421

LAST UPDATE DATE

2025-11-19T23:14:51.284000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-1519date:2023-10-04T00:00:00
db:CNVDid:CNVD-2025-26819date:2025-11-04T00:00:00
db:JVNDBid:JVNDB-2023-028869date:2025-05-14T00:49:00
db:NVDid:CVE-2023-44421date:2025-05-13T14:05:09.173

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-1519date:2023-10-04T00:00:00
db:CNVDid:CNVD-2025-26819date:2025-11-03T00:00:00
db:JVNDBid:JVNDB-2023-028869date:2025-05-14T00:00:00
db:NVDid:CVE-2023-44421date:2024-05-03T03:15:56.233