CVE-2023-35723 is a high severity (CVSS 8.8) command injection flaw in the SOAPAction header handling of prog.cgi on the D-Link DIR-X3260 router. A network-adjacent attacker can run code as root without login. D-Link lists a v1.04B01 beta hotfix as the fix.
What's affected
D-Link announcement SAP10345 lists the DIR-X3260, all A series hardware revisions, with firmware v1.02B02 and below affected. The fixed firmware is v1.04B01 Beta-Hotfix. D-Link supplies it as is and describes it as beta, so read the notes before installing and confirm your hardware revision.
The record and ZDI-23-892 agree on 8.8 with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The announcement lists no CVE, only ZDI-CAN-20983, and does not state an end-of-life status for the model. The record's KEV flag is false.
How to check if you're exposed
- Open the router's admin page and read the firmware version under the system or status menu.
- Compare with v1.02B02. Anything at or below it is affected.
- Confirm the hardware revision is A series by checking the label on the device.
- Check whether the management interface is reachable from guest or untrusted segments.
What to do now
- Install the v1.04B01 beta hotfix from D-Link's support announcement, after confirming the hardware revision.
- Note that it is a beta build. Back up your configuration first and watch the device afterwards.
- Check D-Link's page again for a final release and move to it when it appears.
- Limit access to the router's web interface to trusted hosts.
Why it matters
The weakness is CWE-78. ZDI says the flaw is in how the SOAPAction request header is handled by the prog.cgi endpoint, which passes user-supplied text to a system call without enough validation. Code then runs as root.
This is a classic embedded device bug: a small web handler glues text into a shell command. The fix is validation, and for owners the fix is a firmware update. Because the vendor's fix is a beta, plan on a second update when a final build ships.
Router and access point firmware rarely shows up in software scans. Keep a list of model, firmware version and owner for every network device, review it whenever a vendor advisory lands, and set a date for each update. A list like that turns an advisory into a ten minute check instead of a search.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the D-Link notice give a CVE?
No. It lists ZDI-CAN-20983. The CVE comes from the record.
Is the fix final?
D-Link calls the hotfix a beta provided as is. Check the announcement for later releases.
Sources
Last reviewed: 19 October 2026.
