CVE-2023-34282 is an authentication bypass in the HNAP interface of D-Link DIR-2150 routers, scored 8.8 High. A crafted authentication header lets a network adjacent attacker in without credentials. ZDI says firmware v1.06 fixes it, so update and limit access to the admin interface.
What's affected
The record lists D-Link DIR-2150 routers and their firmware as affected. A crafted authentication header can make authentication succeed without proper credentials. Authentication is not required to exploit it. The ZDI advisory does not give a list of affected firmware versions. It says the issue is fixed in firmware v1.06, so earlier firmware should be assumed vulnerable.
The advisory was released on 15 May 2023 and updated on 2 June 2023, after the flaw was reported to D-Link on 28 April 2023. NVD published the CVE record on 3 May 2024.
How to check if you're exposed
The router's admin page shows the firmware version, usually on a status or firmware update screen. Sign in from a wired device on the LAN and compare the version you see with v1.06, the fixed release named in the ZDI advisory. Anything older than v1.06 should be treated as exposed until you confirm otherwise with D-Link.
You can also look from the outside in. The flaw sits in the SOAP API that the router serves on TCP port 80, so any device on the same network segment that can reach the router's web interface can reach the vulnerable code. If you manage many routers, record the model and firmware version of each one in a spreadsheet or asset inventory so you can answer this question in minutes next time.
What to do now
- Download firmware v1.06 or later for the DIR-2150 from D-Link's support site and check the file against the vendor's published details before installing.
- Install the update from the router's admin page and reboot when asked. Confirm the version shown afterward.
- Until it is patched, limit who can reach the router's web interface. Keep guest and IoT devices on a separate segment from the one used to manage the router.
- Turn off remote management if you do not use it, and change the admin password if it has been the same for years.
- Add the router to your asset list with its firmware version so the next advisory is a lookup, not a search.
Why it matters
An authentication check that can be tricked protects nothing behind it, and here it sits next to the authenticated command injection issues CVE-2023-34280 and CVE-2023-34281 in the same product, though the advisories I read do not say they are linked. A router sits in front of every other device on the network, so a flaw in its management code is worth more to an attacker than the same flaw on a single laptop. For the command injection cases the advisory says code runs as root, which means a successful attacker owns the device and the traffic that passes through it. For the bypass case the advisory describes only access to the system.
The pattern is common in home and small office gear. A web or SOAP handler takes a string from a request and passes it to the operating system without enough checking. Vendors fix it by validating input and by tightening the authentication check in front of it. Customers fix it by installing the firmware, which is the step that most often gets skipped.
The weakness classes involved are CWE-303 (Incorrect Implementation of Authentication Algorithm). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Both NVD and ZDI score this CVE 8.8, so there is no severity conflict. ZDI lists the fix as firmware v1.06 and gives no list of affected builds.
Quick check
Do I need to be on the internet side to be attacked?
The record describes the attack path as network adjacent, which means the attacker must already be on the same local network segment as the router. It does not describe an attack from the open internet. Check that the router's management interface is not exposed to the WAN side, and see the advisory for details.
Which firmware fixes this?
The ZDI advisory says firmware v1.06. It does not list earlier affected builds, so confirm the exact upgrade path with D-Link's support page for the DIR-2150.
Sources
Last reviewed: 19 October 2026.
