CVE-2023-41200 is a command injection flaw in the StaticPrefixLength parameter of the SetHostIPv6StaticSettings request, rated High (CVSS 8.8). It affects D-Link DAP-1325. The vendor fix is firmware v1.09b03 Beta-Hotfix, so update the device and keep its management interface off untrusted networks.
What's affected
The record lists the D-Link DAP-1325 (hardware revision a1) with no firmware range. The D-Link announcement is more specific: all A series hardware revisions on firmware v1.07b01 and below, US region. The fixed build it names is v1.09b03 Beta-Hotfix, last updated 11/23/2022 on that page.
D-Link marks the fix as a beta hotfix. Its page says the build is still undergoing final testing and that you accept the risk of using it.
This CVE is one of several that the same advisory covers. ZDI tracks it as ZDI-23-1308 (ZDI-CAN-18820).
The NVD record scores it 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). ZDI gives the same score.
How to check if you're exposed
Find every DAP-1325 in your asset list. The label on the underside shows the hardware revision, and the admin interface shows the running firmware.
A device on the older firmware is in scope for this CVE. Then list which segments can talk to its management services, because the record describes attackers on the same network as the device.
There is no command that works across every environment here, because this is device firmware and not a package you install. The advisory itself gives no scanning command, so use the version check against the vendor table.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers application dependencies, so it will not see embedded device firmware. Track devices like this in your hardware inventory instead.
What to do now
- List every DAP-1325 you run, with its hardware revision and firmware version.
- Download the vendor build (firmware v1.09b03 Beta-Hotfix) from D-Link and read the advisory page first, because the fix is a beta hotfix.
- Schedule the update. Test it on one unit if you can, since D-Link calls the build beta software.
- Move the management interface to a trusted segment and block access from guest and IoT networks.
- If a unit cannot be updated, plan its replacement and keep it isolated until then.
Hardening steps that go beyond the advisory, such as network segmentation, are general practice and not vendor guidance for this CVE.
Why it matters
The weakness class is CWE-78: OS command injection. According to the advisory, the device builds a system call from a request parameter without validating the string first. A successful attack runs code as root on the device.
A router or access point sits in the path of everyone on the network. Code running as root on it can change settings, watch traffic or serve as a foothold.
This entry covers the StaticPrefixLength parameter of the SetHostIPv6StaticSettings request. Other CVEs in the same D-Link announcement cover other parameters and handlers, and the single firmware update is what addresses them together. ZDI tracked this one internally as ZDI-CAN-18820.
The record marks it as network-adjacent, requiring no privileges, so the attacker needs to be on the same network.
The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read say it is exploited in the wild. That is not a reason to wait, only a note on urgency.
Quick check
Is the D-Link fix a final release?
D-Link lists a beta hotfix as the fix and says it is still under testing. Read the advisory page, test the build, and check whether a final release has replaced it.
Does an attacker need to be on my network?
The record marks the attack vector as network-adjacent, so the attacker needs to share a network segment with the device. Segmenting management access reduces that exposure.
Sources
- NVD-derived record data and Safeguard Gold entry for CVE-2023-41200
- Zero Day Initiative advisory ZDI-23-1308
- D-Link security announcement SAP10351
Last reviewed: 19 October 2026.
