CVE-2023-44427 is a high severity OS command injection flaw in the D-Link DIR-X3260 router, scored 8.0 by NVD. It sits in the SMTPServerAddress field of the email settings call. Neither the NVD record nor the advisory names a fixed firmware version, so check D-Link support for your unit and restrict who can reach the admin interface.
What's affected
The record covers the D-Link DIR-X3260 router and its firmware. It gives no version range, so treat every firmware release as in scope until D-Link says otherwise. The NVD record was published on 2024-05-03, but the Zero Day Initiative advisory ZDI-23-1525 (tracked as ZDI-CAN-21222) is dated 4 October 2023.
The flaw is in prog.cgi, the program that handles HNAP requests for the lighttpd web server on TCP ports 80 and 443. The vulnerable input is the SMTPServerAddress value of the SetSysEmailSettings call. The attack vector is the adjacent network, which means the attacker has to be on the same local network segment as the router.
Authentication is required, but the advisory states that the existing authentication mechanism can be bypassed. NVD scores the issue 8.0 with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and ZDI publishes the same score. I found no conflict between the two on severity.
Three sibling records describe the same bug in other fields of the same call: CVE-2023-44424, CVE-2023-44425, CVE-2023-44426. A fix for one should be checked against all four.
The ZDI page does not name a patched firmware version. It says ZDI reported the issue to the vendor on 5 June 2023 and published it as a zero-day advisory on 4 October 2023 after asking for an update. Whether a firmware release has since closed the gap is not something I could confirm from the sources.
Weakness class: CWE-78 (OS command injection).
How to check if you're exposed
Start by confirming that you actually run this model. The model name is printed on the router label and shown on the admin status page, along with the firmware version. Write both down.
Then look at who can reach the management interface. From a machine on your own network, a quick test shows whether the web ports answer. Replace the address with your router address:
nc -zv 192.168.0.1 80 443
An open result is normal on the LAN. What matters is whether guests, IoT devices or untrusted machines share that network, because the attack vector is adjacent. Finally, open the D-Link support page for the DIR-X3260 and compare your firmware version against the newest release and its notes.
What to do now
- Identify every DIR-X3260 in your estate, including home office units, and record the firmware version of each.
- Check the D-Link support page and security bulletins for a firmware release that addresses these four CVEs. Install it if one is listed, and read the release notes to confirm.
- If no fix is listed, follow the ZDI mitigation advice and restrict interaction with the device: keep untrusted machines and guest Wi-Fi off the network segment that can reach the admin pages.
- Change the router admin password, turn off remote management if it is on, and review whether the email notification feature is in use at all.
- If the device is end of life or unsupported by D-Link, plan a replacement rather than waiting for a patch.
Why it matters
The cause is a classic one. The router takes a string from a request and passes it to a system call without validating it first. That is why the issue is filed as OS command injection. Input that was meant to be an email setting ends up being interpreted by the operating system, and the web server process runs as root, so the result is control of the whole device.
Routers sit at the edge of a network and see all of its traffic. A compromised unit can be used to watch or redirect that traffic, or as a stepping stone to other machines. The adjacent network vector lowers the exposure compared with an internet facing bug, but shared offices, hotels and busy home networks all put strangers on that segment. CVE-2023-44427 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Safeguard's free in-browser dependency scan reads the dependency manifests of your own software, so it will not see router firmware. Use your asset inventory for devices like this one, and use Gold to track the software your teams build.
Quick check
Does CVE-2023-44427 need a login?
Yes, but the advisory says the existing authentication can be bypassed, so do not rely on the login as protection.
Is there a fixed firmware for CVE-2023-44427?
The NVD record and the ZDI advisory do not name one. Check D-Link support for your hardware revision before assuming either way.
Is CVE-2023-44427 exploited in the wild?
It is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory does not report exploitation.
Sources
Last reviewed: 19 October 2026.
