Is CVE-2011-4723 (D-Link DIR-300 Router Cleartext Storage of a Password) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 17, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2011-4723 to its Known Exploited Vulnerabilities catalogue on 8 September 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information. Any organisation running the affected product should treat remediation as urgent.

What “Exploited in the Wild” Means for CVE-2011-4723

CISA’s inclusion of CVE-2011-4723 in the KEV catalogue means the issue is not theoretical. For defenders, the practical question is whether any DIR-300 units remain in service, whether they are reachable from untrusted networks, and whether password exposure could have broader blast-radius impact if the router has been used as an access point, remote admin foothold, or pivot into a larger environment.

Because the flaw is cleartext password storage, the immediate concern is not just device confidentiality but downstream credential exposure. If an attacker can read the stored password, they may be able to reuse it elsewhere, especially where the same administrative secret was reused across other infrastructure, support portals, or legacy appliances.

How to Confirm Exposure and Prioritise Response

Start by inventorying every D-Link DIR-300 instance, then verify whether it is still operational, remotely reachable, and holding any active administrative credentials. For internet-facing or business-critical units, treat the issue as urgent because KEV listing reflects active exploitation, not merely a vendor-declared weakness. The most authoritative references for exploitation status and product tracking are the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database.

Where the router is still in use, confirm whether the stored password was ever used for other systems. Cleartext storage can turn one device flaw into a broader credential incident, so exposure assessment should include any shared passwords, reused admin logins, and service workflows that depended on the router’s secret.

If the device cannot be safely trusted, remove it from service rather than relying on cosmetic hardening alone. For legacy routers that remain operational, the vendor advisory and the KEV entry should be the source of truth for any version-specific mitigation or replacement guidance.

What to Do If Patching or Replacement Must Wait

When immediate replacement is not possible, reduce exposure by limiting management reachability, placing the router behind stronger perimeter controls, and removing any unnecessary remote administration paths. The point is to shrink the set of actors who can touch the secret, because cleartext storage creates a confidentiality problem even before active abuse is detected.

Rotate any password that may have been stored on the device, and treat the router as a credential exposure source until proven otherwise. If the same secret was reused anywhere else, rotate those downstream accounts as well, because the compromise path is often credential reuse rather than direct device takeover.

Do not assume that “no sign of misuse” means no exposure. With a KEV-listed vulnerability, defenders should assume there may already have been opportunistic harvesting, and that the safest response is to replace or retire the device and invalidate any related credentials.

Risk and Threat Considerations

The main risk is credential disclosure from a device that stores passwords in cleartext. That makes the router attractive to both opportunistic attackers and anyone who gains local or administrative access to the device, because the secret can be recovered without breaking encryption or guessing a hash.

Failure mechanism: If the password is stored or retrievable in plaintext, any compromise of the router, backup, configuration export, or management interface can reveal the secret and enable reuse against other systems that trust the same credential.

Impact: The practical impact is often wider than the router itself, because a recovered password can lead to account takeover, lateral access, or persistence elsewhere in the network if the secret was reused.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Legacy routers need secure configuration and exposure reduction.
	CIS-12 — Network Infrastructure Management	Network devices require controlled administration and reduced attack surface.
Recommendation — Harden or retire the router, and remove unnecessary management exposure. Restrict administrative access paths and isolate the device from untrusted networks.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Cleartext password storage directly concerns credential lifecycle and rotation.
	CM-8 — System Component Inventory	You must locate affected routers before remediation can be prioritised.
Recommendation — Rotate exposed credentials and invalidate any reused passwords. Inventory all DIR-300 instances and confirm where they are still in service.

Practitioner Guidance

What to verify: Confirm whether the DIR-300 is still active, whether management access is exposed beyond a trusted admin network, and whether any exported configuration or backup contains reusable credentials.

Decision rule: If the router is still needed, treat replacement as the preferred fix; if it is only lightly used or unsupported, retirement is usually the safer decision than extending the life of a device that has already been publicly exploited.

What to prioritise: Rotate any password that could have been stored on the device before you spend time on secondary hardening, because secret invalidation reduces the blast radius even if the router has already been touched.

Practitioner takeaway: KEV listing makes the issue operationally urgent, but the real security question is whether the exposed password can still authenticate anywhere else in your environment.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org