CVE-2023-44407 is a high severity (CVSS 8.8) stack buffer overflow in the SetAPLanSettings Gateway handler of the D-Link DAP-1325 access point, reachable by an unauthenticated attacker on the same network segment. It can lead to code running as root. The record lists no fixed firmware, so restrict management access and ask D-Link.
What's affected
The record names the D-Link DAP-1325 hardware revision A1 and its firmware, with no firmware version range and no fixed version. ZDI advisory ZDI-23-1505 was published on 4 October 2023 and the CVE record followed on 3 May 2024.
Fix status needs care. In the sister advisory ZDI-23-1501, ZDI records that D-Link said on 30 August 2023 the DAP-1325 issues should be addressed in a previous update, and that ZDI replied on 31 August 2023 that these cases were not included in that update. We fetched that advisory only. We did not fetch ZDI-23-1505 itself, so check it for the history of this specific case. Neither the record nor the advisory we read names a fixed firmware.
The record scores this 8.8 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The A in that vector means adjacent network, so the attacker must be on the same local network or wireless segment, not on the internet. The weakness classes are CWE-121, CWE-787. The record does not mark the CVE as known exploited.
How to check if you're exposed
Start with an inventory, since access points are easy to forget.
- Find every DAP-1325 on your network. Check device labels for the model and hardware revision (A1 is the revision named in the record).
- Log in to each unit's management page and note the firmware version shown there.
- Open D-Link's support pages for the DAP-1325 and compare your firmware with the latest listed release. If the vendor page does not mention these CVEs, treat the device as unfixed.
- Check who can reach the management interface. Anyone on the same segment, including guest Wi-Fi users if the segments are shared, is in scope for this attack.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Put the device on a segment that only administrators can reach, and keep guests and untrusted clients off it.
- Make sure the management interface is not published to the internet through port forwarding or a cloud tunnel.
- Check D-Link's support site for newer DAP-1325 firmware and read its release notes for a mention of these issues before you rely on it.
- If the vendor offers no fix, plan to replace the device, and record the date you made that call.
- Add the model to your asset inventory so future advisories match it quickly.
Why it matters
This is a stack buffer overflow class flaw. XML data sent to the HNAP1 SOAP endpoint is copied into a fixed length stack buffer without a length check. Both patterns come from trusting input that arrives over the network, and both are common in small device firmware where the web service runs with full privileges.
An access point sits in the middle of your traffic. Code running as root on it can see or change what passes through, and a compromised unit is a base for attacking the rest of the local network. ZDI's own mitigation advice for these cases is to restrict interaction with the application, which for a device means limiting who can reach its management service.
Quick check
Can CVE-2023-44407 be exploited from the internet?
The vector is adjacent network, so the attacker needs to be on the same local segment. Exposing the management page to the internet would widen that, which is why you should not do it.
Is there a patched firmware?
The record lists none and the ZDI advisory we read does not confirm a fix. Check D-Link's support page for current status.
Sources
Last reviewed: 19 October 2026.
