CVE-2023-53896 D-Link DAP-1325 Hardware A1 Unauthenticated Configuration Download

What is CVE-2023-53896?

CVE-2023-53896 is a high-severity missing authorization vulnerability in D-Link DAP-1325, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

D-Link DAP-1325 firmware version 1.01 contains a broken access control vulnerability that allows unauthenticated attackers to download device configuration settings without authentication. Attackers can exploit the /cgi-bin/ExportSettings.sh endpoint to retrieve sensitive configuration information by directly accessing the export settings script.

Weakness: CWE-306

Which versions are affected by CVE-2023-53896?

It affects 1 product.

Products include Dlink Dap-1325 Firmware.

How do I fix CVE-2023-53896?

No fix has been published for CVE-2023-53896 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-53896 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53896 exists.

Other vulnerabilities in D-Link DAP-1325

• CVE-2023-41187 D-Link DAP-1325 HNAP Missing Authentication Remote Code Execution Vulnerability High 8.8
• CVE-2023-41188 D-Link DAP-1325 HNAP SetAPLanSettings DeviceName Command Injection Remote Code Execution Vulnerability High 8.8
• CVE-2023-41189 D-Link DAP-1325 HNAP SetAPLanSettings Gateway Command Injection Remote Code Execution Vulnerability High 8.8
• CVE-2023-41190 D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability High 8.8
• CVE-2023-41191 D-Link DAP-1325 HNAP SetAPLanSettings Mode Command Injection Remote Code Execution Vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-326p-rwp7-v23g.