CVE-2025-29635

CVE-2025-29635 is a command-injection vulnerability in D-Link DIR-823X 240126–240802 that can be triggered by a POST to /goform/set_prohibiting, enabling remote command execution by an authenticated attacker. Connected sources document a Mirai-family campaign actively exploiting this flaw to depl...

CVE-2025-2717

CVE-2025-2717 concerns the D-Link DIR-823X family (versions 240126/240802). The vulnerability affects the HTTP POST Request Handler’s diag_nslookup routine, specifically function sub_41710C. By manipulating the argument target_addr, an attacker can induce an OS command injection. The issue is exp...

CVE-2025-0492

CVE-2025-0492 affects D-Link DIR-823X (versions 240126/240802). The issue resides in the function FUN_00412244 and causes a NULL pointer dereference, with remote access possible and the exploit publicly disclosed. Multiple connected sources confirm the vulnerability and its high impact (availabil...

CVE-2025-1103

CVE-2025-1103 affects D-Link DIR-823X (versions 240126–240802). The vulnerability resides in the HTTP POST Request Handler: set_wifi_blacklists (/goform/set_wifi_blacklists). Manipulating the macList argument triggers a null pointer dereference, with remote exploitability and public disclosure. P...

CVE-2025-29039

The CVE-2025-29039 issue affects D-Link DIR-832x devices (firmware version 240802). The root cause is a 0x41dda8 function that fails to properly filter constructed command characters, enabling a remote attacker to execute arbitrary code. Documented impact is remote code execution with high impact...

CVE-2024-39962

CVE-2024-39962 affects the D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router (v21_D240126). The vulnerability is a remote code execution (RCE) in the ntp_zone_val parameter exposed via the /goform/set_ntp endpoint, exploitable through a crafted HTTP request. Multiple connected sources corr...

CVE-2025-29043

CVE-2025-29043 concerns a remote code execution in certain D-Link routers (DIR-832x, firmware 240802 as cited) due to a command-injection vulnerability in the 0x417234 function. The root cause is improper filtering of characters when constructing commands, allowing an unauthenticated attacker to ...

CVE-2025-29042

The CVE-2025-29042 entry concerns D-Link DIR-832x (version 240802) with a command-injection vulnerability in the 0x42232c function triggered via the macaddr parameter, allowing remote arbitrary code execution. Affected component: the 0x42232c handling path in the device firmware; root cause descr...

CVE-2025-29041

D-Link DIR-832x is affected (version 240802). The vulnerability is a command-injection style issue where an attacker can trigger arbitrary code execution through the target_addr key value and the function 0x41710c. The issue is described as a remote code execution risk with high impact. A tempora...

CVE-2025-29040

D-Link DIR-823x devices (firmware build 240802) are affected by a command-injection/remote-code-execution flaw arising from improper handling of the target_addr key value and the function 0x41737c. Reported impact is arbitrary code execution by an unauthenticated remote attacker, potentially comp...

CVE-2026-2084

CVE-2026-2084 affects D-Link DIR-823X (version 250416). A vulnerability in /goform/set_language arises from manipulating the langSelection argument, enabling OS command injection. Attack can be launched remotely and exploits are publicly available. Red Hat/NVD entries confirm the same details; PT...

CVE-2026-1125

CVE-2026-1125 affects D-Link DIR-823X router firmware 250416. The issue resides in the sub_412E7C function within /goform/set_wifidog_settings; manipulating the wd_enable parameter can trigger a remote command injection. Public exploitation appears to be available. Connected sources corroborate t...

CVE-2026-2155

The CVE-2026-2155 entry concerns D-Link DIR-823X (version 250416) and the Configuration Handler’s /goform/set_dmz component. The flaw resides in function sub_4208A0, where manipulating the arguments dmz_host/dmz_enable enables operating system command injection. This allows remote execution of co...

CVE-2025-10123

D-Link DIR-823X routers up to firmware 250416 contain a command injection flaw in the sub_415028 function of /goform/set_static_leases, caused by insufficient input validation of the Hostname parameter. A remote unauthenticated attacker can execute arbitrary commands by sending a crafted request....

CVE-2026-2143

CVE-2026-2143 affects D-Link DIR-823X (firmware 250416), targeting the DDNS Service. The vulnerability stems from improper handling of parameters in the /goform/set_ddns file (ddnsType, ddnsDomainName, ddnsUserName, ddnsPwd) enabling remote OS command injection. The issue enables remote execution...

CVE-2026-2175

CVE-2026-2175 affects D-Link DIR-823X (firmware 250416). Exploit targets the function sub_420618 in /goform/set_upnp; manipulating the upnp_enable argument leads to OS command injection with remote exploitation possible and a publicly released exploit. The vulnerability is confirmed as high sever...

CVE-2026-2210

CVE-2026-2210 affects D-Link DIR-823X (firmware 250416). The issue is in function sub_4211C8 of /goform/set_filtering, where input manipulation permits OS command injection. Exploitation can be remote over the network, and public disclosure of the exploit is noted. No patch/version details are pr...

CVE-2026-2157

D-Link DIR-823X 250416 is affected by CVE-2026-2157. The vulnerability is in the function sub_4175CC of /goform/set_static_route_table, where manipulating arguments (interface, destip, netmask, gateway, metric) enables OS command injection. Attack can be performed remotely and public exploits hav...

CVE-2026-1544

CVE-2026-1544 affects D-Link DIR-823X (firmware 250416). The vulnerability is in the function sub_41E2A0 of /goform/set_mode, where manipulation of the lan_gateway argument enables remote command injection. Exploitation has been publicly released, and the issue affects devices no longer supported...

CVE-2026-1685

The CVE-2026-1685 entry concerns D-Link DIR-823X 250416. Affects the Login component, specifically function sub_40AC74, where manipulation leads to improper restriction of excessive authentication attempts. The attack can be performed remotely and is described as high complexity with difficult ex...

CVE-2026-2142

CVE-2026-2142 concerns D-Link DIR-823X firmware (build 250416). The vulnerability affects the function sub_420688 in /goform/set_qos, allowing remote OS command injection via manipulation of that function. Public exploit code is available, enabling remote attacks with high impact on confidentiali...

CVE-2026-2081

CVE-2026-2081 affects D-Link DIR-823X (build 250416). Affected component is an unknown function in /goform/set_password where manipulating the http_passwd argument causes OS command injection. The vulnerability is exploitable remotely and exploitation has been publicly disclosed. Documentation in...

CVE-2026-2120

CVE-2026-2120 affects D-Link DIR-823X 250416. The issue is an OS command injection in the Configuration Parameter Handler, triggered by manipulating arguments in /goform/set_server_settings (terminal_addr, server_ip, server_port). The attack can be remote and publicly available exploits exist. Af...

CVE-2025-10634

CVE-2025-10634 affects D-Link DIR-823X routers (versions 240126, 240802, 250416). The issue is in the Environment Variable Handler’s /usr/sbin/goahead component, specifically function sub_412E7C, where manipulating arguments terminal_addr/server_ip/server_port enables remote command injection. Th...

CVE-2026-2061

The CVE-2026-2061 entry concerns D-Link DIR-823X (firmware 250416). The affected component is the function sub_424D20 in /goform/set_ipv6, where input manipulation leads to OS command injection. Impact is remote code execution with high severity; attack vector is network, no user interaction requ...

CVE-2025-10814

The CVE-2025-10814 entry concerns D-Link DIR-823X routers (versions 240126/240802/250416) with a vulnerability in /usr/sbin/goahead. An attacker can remotely inject commands by manipulating the port argument, leading to command execution. Public exploit information exists. No remediation details ...

CVE-2025-11095

CVE-2025-11095 affects D-Link DIR-823X (firmware 250416). The vulnerability is a command-injection in /goform/delete_offline_device via manipulation of the delvalue parameter, enabling remote exploitation. Exploit publicly available; multiple connected sources corroborate the issue. No remediatio...

CVE-2026-2129

The CVE-2026-2129 affects D-Link DIR-823X (firmware 250416). The vulnerability resides in /goform/set_ac_status where manipulating ac_ipaddr, ac_ipstatus, or ap_randtime can trigger an OS command injection. The issue can be exploited remotely, and public exploit code exists. Multiple sources corr...

CVE-2026-2063

CVE-2026-2063 affects D-Link DIR-823X 250416; the Web Management Interface’s /goform/set_ac_server is vulnerable to an OS command injection via the ac_server parameter. The flaw can be exploited remotely and there is public exploit activity. Remediation guidance across sources mentions applying u...

CVE-2025-10401

CVE-2025-10401 concerns the D-Link DIR-823x family (firmware up to 250416). The vulnerability exists in the diag_ping handling (file path /goform/diag_ping) where manipulation of the target_addr argument enables arbitrary command execution via a command-injection flaw. It is a remote exploit with...

CVE-2025-14208

CVE-2025-14208 affects D-Link DIR-823X devices up to 20250416. The vulnerability resides in the function sub_415028 of /goform/set_wan_settings, where manipulating the argument ppp_username leads to command injection. Exploitation can be performed remotely, and public proof-of-concept/exploit mat...

CVE-2025-11098

CVE-2025-11098 affects D-Link DIR-823X firmware 250416. The vulnerability resides in an unknown function in /goform/set_wifi_blacklists where manipulating the macList argument enables remote command injection. Impact is high for confidentiality, integrity, and availability per NVD/CNA notes; expl...

CVE-2025-11100

CVE-2025-11100 affects D-Link DIR-823X (firmware 250416). The uci_set function in /goform/set_wifi_blacklists is vulnerable to remote command injection; exploitation can occur over the network and a public exploit exists. Several sources (NVD, Red Hat, CNVD, CVE lists) confirm remote exploitation...

CVE-2025-11096

The CVE-2025-11096 entry concerns D-Link DIR-823X (version 250416) and a command-injection flaw in the /goform/diag_traceroute handler. The root cause is manipulation of the target_addr argument, enabling remote code execution. The vulnerability is reported as exploitable remotely and an exploit ...

CVE-2026-2082

CVE-2026-2082 affects D-Link DIR-823X (build 250416). The flaw lies in the /goform/set_mac_clone path where manipulating the argument mac allows an os command injection due to an identified vulnerable function. This enables remote attackers to execute commands with high privileges; exploitation i...

CVE-2025-11092

CVE-2025-11092 affects D-Link DIR-823X 250416. The issue lies in the function sub_412E7C in /goform/set_switch_settings where manipulating the port argument leads to remote command injection. Exploitation is possible over the network; public exploit exists. Red Hat and CNVD entries corroborate a ...

CVE-2025-55848

CVE-2025-55848 affects the DIR-823 family (firmware 20250416). Root cause: the set_cassword/settings interface does not properly filter the http_casswd parameter, enabling code execution via injection of reverse-connection commands. Impact stated across sources is remote code execution with high ...

CVE-2025-11097

CVE-2025-11097 affects D-Link DIR-823X firmware 250416. The root cause is a command injection in the /goform/set_device_name handler caused by manipulating the mac parameter. The vulnerability is exploitable remotely and has been publicly disclosed. Multiple sources (NVD, Red Hat, CNVD, CNVD) cor...

CVE-2025-11099

CVE-2025-11099 affects D-Link DIR-823X (firmware 250416). The vulnerability resides in the uci_del function of /goform/delete_prohibiting, where tampering with the delvalue parameter enables remote command injection. Exploitation can be performed remotely, and a public exploit has been disclosed....