The vulnerability of the sub_4208A0 function (/goform/set_dmz) in the Configuration Handler component of the D-link DIR-823X microprogrammable router software allows a attacker to execute arbitrary commands.

The vulnerability of the sub4208A0 /goform/setdmz function in the Configuration Handler component of the D-link DIR-823X router microprogramming system is related to the failure to take measures to neutralize special elements during the processing of the dmzhost/dmzenable parameter. Exploiting th...

CVE-2026-2155: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub4208A0 of the file /goform/setdmz of the component Configuration Handler. The manipulation of the argument dmzhost/dmzenable results in os command injection. The attack can be executed remotely...