CVE-2023-44839

Deeper analysis

D-Link DIR-823G firmware version A1V1.0.2B05 contains a buffer overflow vulnerability in the SetWLanRadioSecurity function triggered by the Encryption parameter. The flaw is tracked as CVE-2023-44839, carries a CVSS 3.1 score of 7.5, and is classified under CWE-120. Successful exploitation results in a denial-of-service condition that disrupts wireless radio security handling.

An unauthenticated attacker with network access can submit a crafted HTTP request containing an oversized or malformed Encryption value to the affected function. Because the device performs no authentication or input-length validation before copying the parameter into a fixed-size buffer, the overflow corrupts memory and forces the device to reboot or become unresponsive.

Public references point to a D-Link security bulletin page and a GitHub repository that reproduces the crash, but neither source supplies a firmware update or configuration workaround at the time of disclosure.

The CVE’s EPSS score rose from a low baseline to a peak of 0.1471 before settling at the current value of 0.1117, indicating measurable post-disclosure exploitation interest that warrants renewed monitoring.