CVE-2023-44415 is a high severity (CVSS 8.0) command injection flaw in the CLI service on TCP port 23 of D-Link DIR-1260 and DIR-2150 routers. An authenticated attacker on the same network can run code as root. The fix status is unconfirmed, so restrict access and check with D-Link.
What's affected
The record's description names the DIR-1260 and DIR-2150 routers. Its product list includes both models as well. ZDI advisory ZDI-23-1513 is the source, and the advisory we read lists only the DIR-2150 in its Affected Products field, so the two disagree on whether the DIR-1260 is covered. Treat both models as in scope until D-Link says otherwise.
Severity also differs between sources. The record scores this 8.0 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while the ZDI advisory lists a score of 6.8. Both use different base metrics. We use the record's figure in the title.
On fix status, ZDI recorded that on 30 August 2023 the vendor said the issue might be fixed but would need verification. No confirmed patch is listed. The weakness is CWE-78. The record does not mark the CVE as known exploited.
How to check if you're exposed
- Identify any DIR-1260 or DIR-2150 on your network by device label and the management page.
- Note the firmware version on each.
- Check whether the CLI service is reachable. From a machine on the same segment, test whether TCP port 23 accepts a connection, using your usual port scanner or a plain telnet client to the router address. Only test devices you own.
- Compare your firmware with the latest on D-Link's support pages, and read release notes for any mention of this CVE.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- If you do not need the CLI service, disable it or block TCP port 23 to the router from user networks.
- Change default and shared administrator passwords, because the attack needs a login.
- Keep the management interface off the internet.
- Ask D-Link for written confirmation of which firmware, if any, fixes the issue for each model.
- Plan replacement if the vendor cannot confirm a fix.
Why it matters
Command injection happens when a program builds an operating system command from text a user supplied and does not check it. The attacker's text becomes part of the command. In this case the command runs as root on the router.
The attack needs authentication, which lowers the risk compared with the unauthenticated bugs in nearby CVEs. But router passwords are often default or shared, and Telnet sends credentials in clear text on the local network. Anyone watching that segment may capture a login first.
Quick check
Does the attacker need a password?
Yes. The record and ZDI both say authentication is required. The attacker also needs to be on the adjacent network.
Which models are affected?
The record names the DIR-1260 and DIR-2150. The ZDI advisory field lists only the DIR-2150, so check both.
Sources
Last reviewed: 19 October 2026.
