CVE-2023-44418 is a high severity (CVSS 8.8) heap based buffer overflow in prog.cgi on the D-Link DIR-X3260 router. An unauthenticated attacker on the adjacent network can run code as root. The record lists no fixed firmware, so restrict access to the management interface and ask D-Link for status.
What's affected
The record names the D-Link DIR-X3260 and its firmware, without a version range or a fixed version. The flaw is in prog.cgi, which handles HNAP requests made to the lighttpd web server. The source is ZDI advisory ZDI-23-1516, published 4 October 2023, and the CVE record dates from 3 May 2024.
On fix status: On 30 August 2023 the vendor told ZDI the fix was still under development. For the related cases in this batch, ZDI-23-1516 and ZDI-23-1518 both show the vendor saying a fix was still in development as of 30 August 2023. That is the last vendor statement we saw. It does not confirm that a patch exists now, so check D-Link's pages.
The record scores the flaw 8.8 (High), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: adjacent network, low complexity, no privileges, no user interaction. The weaknesses are CWE-122, CWE-787. The record does not mark the CVE as known exploited.
How to check if you're exposed
- Find every DIR-X3260 in use, including units given to remote staff.
- Log in to each management page and write down the firmware version.
- Compare with the newest firmware on D-Link's DIR-X3260 support page and read its release notes for any reference to this CVE or to ZDI-CAN-20727.
- Check who can reach ports 80 and 443 on the router from the local network, including guest Wi-Fi.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Separate guest and untrusted devices from the segment that can reach the router's web interface.
- Keep remote administration off, so the HNAP service is not published to the internet.
- Update to any newer firmware D-Link lists, after reading its notes.
- Ask D-Link in writing whether this CVE is fixed and in which firmware.
- If no fix exists, plan to replace the router.
Why it matters
A heap based buffer overflow happens when code copies network data into a fixed size area of memory without checking its length. On the heap, the overflow can corrupt neighbouring allocations, which skilled attackers can sometimes turn into code execution. Here the vulnerable code is part of the web service that runs as root.
Routers are attractive because they sit on the path of all traffic. Code running as root on one can watch traffic or change DNS and routing settings. The attack path here is limited to the local network, which is why segmentation and a closed management interface reduce the risk a lot.
Quick check
Does CVE-2023-44418 need a login?
No. The record says authentication is not required, though the attacker must be on the adjacent network.
Is a patch available?
The record names none. Check D-Link's support page and confirm in writing.
Sources
Last reviewed: 19 October 2026.
