CVE-2023-53896

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

D-Link DAP-1325 firmware version 1.01 contains a broken access control vulnerability that allows unauthenticated attackers to download device configuration settings without authentication. Attackers can exploit the /cgi-bin/ExportSettings.sh endpoint to retrieve sensitive configuration information by directly accessing the export settings script.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
D-Link	DAP-1325	1.01

References

https://www.dlink.com/hr/hr/products/dap-1325-n300-wifi-range-extenderProduct
https://www.exploit-db.com/exploits/51556Exploit
https://www.vulncheck.com/advisories/d-link-dap-hardware-a-unauthenticated-configuration-downloadBroken Link, Third Party Advisory

Timeline

Published: Dec 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-538975.4Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scrip CVE-2023-538985.4Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Att CVE-2023-538999.8PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload CVE-2023-53905.3An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and CVE-2023-539006.1Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers CVE-2023-539016.1WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrok CVE-2023-539026.5WebsiteBaker 2.13.3 contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary files by manipulati CVE-2023-539035.4WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with CVE-2023-539044.6Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts thr CVE-2023-539058.0ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile name CVE-2023-539064.8projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScri CVE-2023-539076.5Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to acces