CVE-2023-34276 is a command injection flaw in the D-Link DIR-2150 router SOAP API, in the SetTriggerPPPoEValidate action. NVD scores it high (CVSS 8.0) while ZDI scores it 6.8. ZDI says firmware v1.06 fixes the flaw, so update the router and limit who can reach its management page.
What's affected
- D-Link DIR-2150 routers, per the NVD record. The record lists the firmware without a version range.
- ZDI states the issue is fixed in firmware v1.06, available from D-Link's support download page for the DIR-2150.
- The attacker must be network-adjacent, meaning on the same local network segment.
The weakness is CWE-78, improper neutralization of special elements used in an OS command.
How to check if you're exposed
Log in to the router administration page and read the firmware version on the status or maintenance page. ZDI says v1.06 contains the fix, so treat older firmware as exposed.
Also check whether the administration interface is reachable from guest networks or from the internet. ZDI says the SOAP API listens on TCP port 80 by default. From a computer on the network you can test whether the router answers on that port, and from outside you should confirm that remote administration is off.
If you manage many routers, list the model and firmware of each in an inventory so older units are visible.
What to do now
- Download firmware v1.06 or later from the D-Link support site for the DIR-2150, and verify the file source.
- Back up the router configuration, apply the update, and confirm the new version on the status page.
- Turn off remote administration, and keep guest and untrusted devices on a separate network from the router management interface.
- Change the administrator password after updating, and use a unique password.
- If the model no longer receives updates in your region, plan a replacement.
If you track software dependencies, the free in-browser dependency scan can show which of your components carry known CVEs, and the Gold directory lists the same records in one place.
Why it matters
The router's SOAP API listens on TCP port 80 by default. ZDI says the PPPoE username field reaches a system call without proper validation, so the router runs attacker-supplied text as an operating system command, and does so as root. The class is CWE-78.
Authentication is required, but ZDI notes that the existing authentication mechanism can be bypassed, a separate flaw tracked as CVE-2023-34274 for this router. That pairing is why the combined risk is higher than either score suggests.
Severity differs by source. NVD records CVSS 8.0 with low privileges required. ZDI lists 6.8 with high privileges required. Treat it as high until the router is patched.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Which firmware fixes it?
ZDI says the issue is fixed in firmware v1.06. Confirm on the D-Link support page for your region.
Can someone attack from the internet?
The vector is network-adjacent, so the attacker must be on the local network. Exposing the management interface to the internet would widen that, so keep remote administration off.
Sources
Last reviewed: 19 October 2026.
