CVE-2025-11096: Improper Neutralization of Special Elements used in a Command

A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diagtraceroute. Executing manipulation of the argument targetaddr can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used...

CVE-2025-11098: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/setwifiblacklists. The manipulation of the argument macList results in command injection. The attack may be performed from remote. The exploit has been made public and could be use...

PT-2025-39759

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A flaw exists in D-Link DIR-823X 250416 that allows remote command injection. The issue is located in an unknown function of the file /goform/set device name. Manipulating the mac argument can trigger...

PT-2025-39761

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A flaw exists in the D-Link DIR-823X router. Specifically, manipulating the delvalue argument within the uci del function in the /goform/delete prohibiting file can lead to command injection. This...

D-Link DIR-823X 命令注入漏洞

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability that stems from a misuse of the parameter mac in the file /goform/setdevicename, which can be exploited by an attacker to cause remote command injection...

D-Link DIR-823X 命令注入漏洞

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability that originates from a misuse of the parameter delvalue in the file /goform/deleteofflinedevice, which can be exploited by an attacker to cause a command injection...

PT-2025-39758

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A flaw exists in the processing of the /goform/diag traceroute file within D-Link DIR-823X version 250416. Manipulation of the target addr argument can lead to command injection, allowing for remote...

PT-2025-39762

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A flaw exists in the uci set function within the /goform/set wifi blacklists file. This allows for remote command injection through manipulation. The exploit is publicly available. Recommendations At...

D-Link DIR-823X 命令注入漏洞

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability that can be exploited by an attacker to cause remote command execution...

D-Link DIR-823X 命令注入漏洞

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability that originates from the misuse of the parameter macList in the file /goform/setwifiblacklists, which can be exploited by an attacker to cause remote command...

CVE-2025-11097: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/setdevicename. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be...

CVE-2025-11099: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function ucidel of the file /goform/deleteprohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed...

CVE-2025-11092: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub412E7C of the file /goform/setswitchsettings. This manipulation of the argument port causes command injection. The attack may be initiated remotely. The exploit has been made available to the publi...

CVE-2025-7647

CVE-2025-7647 affects llama-index-core up to version 0.12.44, with a vulnerability in get_cache_dir() that uses a predictable, hardcoded directory path (/tmp/llama_index) on Linux. On multi-user Linux systems, this insecure temporary directory can enable local attackers to steal proprietary model...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

CVE-2025-55848: Improper Neutralization of Special Elements used in a Command

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

D-Link DIR-823X 安全漏洞

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command execution vulnerability that can be exploited by an attacker to cause code execution due to the setcassword settings interface not filtering special characters in the httpcasswd parameter...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...