CVE-2023-41229 is a heap-based buffer overflow in the Referer header in HTTP request processing, rated High (CVSS 8.8). It affects D-Link DIR-3040. The vendor fix is v1.20B03 Beta-Hotfix, so update the device and keep its management interface off untrusted networks.
What's affected
The record lists the D-Link DIR-3040 with no firmware range. The D-Link announcement names all A series hardware revisions, US region, on firmware v120B03 and below. The fixed build it names is v1.20B03 Beta-Hotfix, last updated 08/302023 as printed on that page.
Those two version labels look nearly identical, so read the advisory page and the firmware download page for your exact build before you decide a device is patched.
D-Link marks the fix as a beta hotfix. Its page says the build is still undergoing final testing and that you accept the risk of using it. It also says the hotfix was going through full QA and would reach the automatic download server once validated.
This CVE is one of several that the same advisory covers. ZDI tracks it as ZDI-23-1337 (ZDI-CAN-21671).
The NVD record scores it 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). ZDI gives the same score.
How to check if you're exposed
Check the hardware revision on the label under the device, or in its web configuration. Then read the firmware version in the admin interface and compare it with the affected and fixed builds above.
Next, ask whether the device is reachable by anyone who should not have it. The vulnerable service is part of the network management surface of the device, and the record marks it as network-adjacent, so the exposure is mostly about which hosts share a network segment with the device.
There is no command that works across every environment here, because this is device firmware and not a package you install. The advisory itself gives no scanning command, so use the version check against the vendor table.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers application dependencies, so it will not see embedded device firmware. Track devices like this in your hardware inventory instead.
What to do now
- List every DIR-3040 you run, with its hardware revision and firmware version.
- Download the vendor build (v1.20B03 Beta-Hotfix) from D-Link and read the advisory page first, because the fix is a beta hotfix.
- Schedule the update. Test it on one unit if you can, since D-Link calls the build beta software.
- Move the management interface to a trusted segment and block access from guest and IoT networks.
- If a unit cannot be updated, plan its replacement and keep it isolated until then.
Hardening steps that go beyond the advisory, such as network segmentation, are general practice and not vendor guidance for this CVE.
Why it matters
The weakness class is CWE-122 and CWE-787: a heap-based buffer overflow, which is an out-of-bounds write. The advisory says a user-supplied string is copied into a heap buffer without a length check.
The vulnerable code handles web requests, so the input comes from anyone who can send a request to the device.
This entry covers the Referer header in HTTP request processing. Other CVEs in the same D-Link announcement cover other parameters and handlers, and the single firmware update is what addresses them together. ZDI tracked this one internally as ZDI-CAN-21671.
The record marks it as network-adjacent, requiring no privileges, so the attacker needs to be on the same network.
The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read say it is exploited in the wild. That is not a reason to wait, only a note on urgency.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the D-Link fix a final release?
D-Link lists a beta hotfix as the fix and says it is still under testing. Read the advisory page, test the build, and check whether a final release has replaced it.
Does an attacker need to be on my network?
The record marks the attack vector as network-adjacent, so the attacker needs to share a network segment with the device. Segmenting management access reduces that exposure.
Sources
- NVD-derived record data and Safeguard Gold entry for CVE-2023-41229
- Zero Day Initiative advisory ZDI-23-1337
- D-Link security announcement SAP10350
Last reviewed: 19 October 2026.
