CVE-2023-44420 is a high severity (CVSS 8.8) authentication bypass in prog.cgi on the D-Link DIR-X3260 router. The authentication algorithm is implemented incorrectly, so an adjacent network attacker can bypass it without credentials. No fixed firmware is listed, so restrict management access and ask D-Link.
What's affected
The record names the DIR-X3260 and its firmware, with no version range or fix. ZDI advisory ZDI-23-1518 is the source. In it, ZDI says the vendor reported on 30 August 2023 that the fix was still under development. That is the last vendor statement in the advisory, and it does not confirm a patch.
The record scores the issue 8.8 (High), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is CWE-303, an incorrect implementation of an authentication algorithm. The record does not mark the CVE as known exploited.
This CVE matters beyond itself. Three other CVEs in this batch (CVE-2023-44421, CVE-2023-44422 and CVE-2023-44423) are command injection flaws that need a login, and ZDI notes the existing authentication can be bypassed. Those are the same router and the same family of weaknesses.
How to check if you're exposed
- Locate each DIR-X3260 and note the firmware version from its management page.
- Check D-Link's support page for newer firmware and read the release notes for this CVE or ZDI-CAN-21100.
- Check who can reach the router's web interface on TCP ports 80 and 443 from inside your network.
- Review the router configuration for unexpected changes, such as DNS servers, port forwards or admin accounts you did not create.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Restrict the management interface to a small administrative segment.
- Never expose remote administration to the internet.
- Install any newer firmware from D-Link after reading its notes.
- Check DNS, routing and account settings for changes you did not make.
- Replace the device if D-Link cannot confirm a fix.
Why it matters
An authentication bypass is a flaw in the check that decides who is allowed in. A strong password does not help if the check itself can be tricked. The record says the algorithm is implemented incorrectly, which means the code does not correctly decide whether a request is authenticated.
Bypasses like this are useful as the first step of a chain. Once past the login, an attacker can reach features that normally require an administrator, including those with their own flaws. That is why the command injection CVEs in the same router are scored as needing a login yet still reachable.
Quick check
Does a strong admin password protect against this?
Not reliably. The flaw is in how authentication is implemented, so the check can be bypassed whatever the password is.
Is the attack remote?
The vector is adjacent network, so the attacker needs to be on the local segment.
Sources
Last reviewed: 19 October 2026.
