CVE-2025-11099

A vulnerability was identified in D-Link DIR-823X 250416, involving command injection in function uci_set of /goform/set_wifi_blacklists. Manipulation leads to remote command execution. The exploit is publicly available.

A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. Manipulation of the argument macList results in command injection. The attack may be performed from remote, and the exploit has been made public.

A vulnerability was found in D-Link DIR-823X 250416, involving command injection in /goform/set_device_name. Manipulation of mac allows remote command execution. The exploit is publicly disclosed.

A flaw was found in D-Link DIR-823X 250416, involving command injection in /goform/diag_traceroute. Manipulation of target_addr allows remote command execution. The exploit is published.

A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Manipulation of the argument delvalue results in command injection. Remote exploitation is possible, and the exploit is now public.

A weakness was identified in D-Link DIR-823X 250416, involving command injection in function sub_412E7C of /goform/set_switch_settings. Manipulation of port allows remote command execution. The exploit is publicly available.

A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminal_addr/server_ip/server_port causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.