CVE-2023-34280 is a command injection flaw in the SetSysEmailSettings call of D-Link DIR-2150 routers, scored 8.0 High. An adjacent attacker who gets past authentication can run code as root. ZDI says firmware v1.06 fixes it, so update and limit access to the admin interface.
What's affected
The record lists D-Link DIR-2150 routers and their firmware as affected. The SetSysEmailSettings function takes an EmailTo value and uses it in a system call without proper validation. Authentication is required, but the advisory says the existing authentication can be bypassed. The ZDI advisory does not give a list of affected firmware versions. It says the issue is fixed in firmware v1.06, so earlier firmware should be assumed vulnerable.
The advisory was released on 15 May 2023 and updated on 2 June 2023, after the flaw was reported to D-Link on 28 April 2023. NVD published the CVE record on 3 May 2024.
How to check if you're exposed
The router's admin page shows the firmware version, usually on a status or firmware update screen. Sign in from a wired device on the LAN and compare the version you see with v1.06, the fixed release named in the ZDI advisory. Anything older than v1.06 should be treated as exposed until you confirm otherwise with D-Link.
You can also look from the outside in. The flaw sits in the SOAP API that the router serves on TCP port 80, so any device on the same network segment that can reach the router's web interface can reach the vulnerable code. If you manage many routers, record the model and firmware version of each one in a spreadsheet or asset inventory so you can answer this question in minutes next time.
What to do now
- Download firmware v1.06 or later for the DIR-2150 from D-Link's support site and check the file against the vendor's published details before installing.
- Install the update from the router's admin page and reboot when asked. Confirm the version shown afterward.
- Until it is patched, limit who can reach the router's web interface. Keep guest and IoT devices on a separate segment from the one used to manage the router.
- Turn off remote management if you do not use it, and change the admin password if it has been the same for years.
- Add the router to your asset list with its firmware version so the next advisory is a lookup, not a search.
Why it matters
Command injection happens when input that should be data is treated as part of a command. A router sits in front of every other device on the network, so a flaw in its management code is worth more to an attacker than the same flaw on a single laptop. For the command injection cases the advisory says code runs as root, which means a successful attacker owns the device and the traffic that passes through it. For the bypass case the advisory describes only access to the system.
The pattern is common in home and small office gear. A web or SOAP handler takes a string from a request and passes it to the operating system without enough checking. Vendors fix it by validating input and by tightening the authentication check in front of it. Customers fix it by installing the firmware, which is the step that most often gets skipped.
The weakness classes involved are CWE-78 (OS Command Injection). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict: NVD scores this CVE 8.0 High (vector AV:A/AC:L/PR:L), while the ZDI advisory lists 6.8 (vector with PR:H). Both are shown here. The advisory notes that the authentication this attack needs can be bypassed, and CVE-2023-34282 is an authentication bypass in the same product, though the advisories I read do not say the two are linked.
Quick check
Do I need to be on the internet side to be attacked?
The record describes the attack path as network adjacent, which means the attacker must already be on the same local network segment as the router. It does not describe an attack from the open internet. Check that the router's management interface is not exposed to the WAN side, and see the advisory for details.
Which firmware fixes this?
The ZDI advisory says firmware v1.06. It does not list earlier affected builds, so confirm the exact upgrade path with D-Link's support page for the DIR-2150.
Sources
Last reviewed: 19 October 2026.
