CVE-2023-44421 is a high severity (CVSS 8.0) command injection flaw in the SetTriggerPPPoEValidate Username request handler of the D-Link DIR-X3260 router. An adjacent attacker with a login, which the authentication flaw can bypass, can run code as root. No fix is listed, so restrict access.
What's affected
The record names the D-Link DIR-X3260 and its firmware, with no version range and no fixed version. The source is ZDI advisory ZDI-23-1519 (ZDI-CAN-21101). We fetched ZDI-23-1519 for this batch, and it records no vendor response and no patch. We did not fetch the other two advisories in this trio.
The record scores the issue 8.0 (High), vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The PR:L in that vector means a low privilege account is required. The record's description adds that although authentication is required, the existing authentication mechanism can be bypassed. That ties this CVE to CVE-2023-44420, an authentication bypass in the same router.
The weakness is CWE-78, OS command injection, in prog.cgi, which handles HNAP requests made to the lighttpd web server on TCP ports 80 and 443. The record does not mark the CVE as known exploited.
How to check if you're exposed
- Find every DIR-X3260 and record the firmware version.
- Look on D-Link's support page for newer firmware. Read the release notes for any mention of CVE-2023-44421 or ZDI-CAN-21101.
- Check which hosts can reach the router on TCP ports 80 and 443. Include guest Wi-Fi if it shares a segment.
- Review configuration for changes, such as new admin accounts, changed DNS or unexpected mail settings.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Limit the management interface to an administrative segment.
- Use a strong, unique administrator password, even though the bypass flaw means this alone is not enough.
- Keep remote administration off.
- Apply any newer D-Link firmware after reading its notes, and ask D-Link in writing whether this CVE is fixed.
- Replace the router if no fix is available.
Why it matters
Command injection means that text supplied by a user ends up inside an operating system command without being checked. The Username field here is one such input. The attacker places command text in it, and the router runs that text as root.
The record notes the login requirement can be bypassed, so the lower score for needing authentication overstates the protection. When a family of CVEs affects one binary, such as prog.cgi on this router, it is a sign that input handling is weak across many handlers. Fixing one field does not clear the others.
Quick check
Why is CVE-2023-44421 scored 8.0 and not 8.8?
The vector requires a low privilege account, which lowers the score. The record notes that the authentication can be bypassed.
What is the best interim control?
Limit who can reach the router's web interface and keep remote administration off.
Sources
Last reviewed: 19 October 2026.
