CVE-2023-34274 is a high severity (CVSS 8.8) authentication bypass in the SOAP API of the D-Link DIR-2150 router. A network-adjacent attacker can send a crafted login request and be accepted without any credentials. ZDI says firmware v1.06 fixes it, so update the router soon.
What's affected
- D-Link DIR-2150 routers, per the NVD record. The record lists the firmware without a version range.
- ZDI states the issue is fixed in firmware v1.06, available from D-Link's support download page for the DIR-2150.
- The attacker must be network-adjacent, meaning on the same local network segment.
The weakness is CWE-303, incorrect implementation of an authentication algorithm. ZDI tracked the report as ZDI-CAN-20552.
How to check if you're exposed
Log in to the router administration page and read the firmware version on the status or maintenance page. ZDI says v1.06 contains the fix, so treat older firmware as exposed.
Also check whether the administration interface is reachable from guest networks or from the internet. ZDI says the SOAP API listens on TCP port 80 by default. From a computer on the network you can test whether the router answers on that port, and from outside you should confirm that remote administration is off.
If you manage many routers, list the model and firmware of each in an inventory so older units are visible.
What to do now
- Download firmware v1.06 or later from the D-Link support site for the DIR-2150, and verify the file source.
- Back up the router configuration, apply the update, and confirm the new version on the status page.
- Turn off remote administration, and keep guest and untrusted devices on a separate network from the router management interface.
- Change the administrator password after updating, and use a unique password.
- If the model no longer receives updates in your region, plan a replacement.
If you track software dependencies, the free in-browser dependency scan can show which of your components carry known CVEs, and the Gold directory lists the same records in one place.
Why it matters
The router's SOAP API listens on TCP port 80 by default. ZDI says the login routine implements the authentication algorithm incorrectly, so a crafted request is accepted as valid. The class is CWE-303, incorrect implementation of an authentication algorithm.
This flaw is also the key that unlocks the others in this family. The four command injection issues ZDI published for the same router each say authentication is required but can be bypassed. Chained, a neighbor on the same network could gain root. That is why patching the firmware matters more than judging the injection scores alone.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Which firmware fixes it?
ZDI says the issue is fixed in firmware v1.06. Confirm on the D-Link support page for your region.
Can someone attack from the internet?
The vector is network-adjacent, so the attacker must be on the local network. Exposing the management interface to the internet would widen that, so keep remote administration off.
Sources
Last reviewed: 19 October 2026.
