CVE-2023-44425

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.0HIGH

EPSS

0.1%

top 73.85%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-x3260 Firmware D-link Dir-x3260

Timeline

PublishedMay 3

Description

D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

▶NVDdlink/dir-x3260_firmware< 1.04b01

▶CVEListV5d-link/dir-x32601.02B02

🔴Vulnerability Details

CVEList

D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability↗2024-05-03

▶

GHSA

GHSA-23v6-5g43-4fhp: D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability↗2024-05-03

▶