CVE-2025-14208
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
A security flaw has been discovered in D-Link DIR-823X up to 20250416. This affects the function sub_415028 of the file /goform/set_wan_settings. The manipulation of the argument ppp_username results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, taking control and compromising the entire network.
Recommendation
Immediately update D-Link DIR-823X firmware to the latest version or disable remote access to the management interface.
Other vulnerabilities in D-Link DIR-823X
See all- CVE-2025-11100Medium
A vulnerability was identified in D-Link DIR-823X 250416, involving command injection in function uci_set of /goform/set_wifi_blacklists. Manipulation leads to remote command execution. The exploit is publicly available.
- CVE-2025-11099Medium
A vulnerability was determined in D-Link DIR-823X 250416, involving command injection in function uci_del of /goform/delete_prohibiting. Manipulation of delvalue allows remote command execution. The exploit is publicly disclosed.
- CVE-2025-11098Medium
A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. Manipulation of the argument macList results in command injection. The attack may be performed from remote, and the exploit has been made public.
- CVE-2025-11097Medium
A vulnerability was found in D-Link DIR-823X 250416, involving command injection in /goform/set_device_name. Manipulation of mac allows remote command execution. The exploit is publicly disclosed.
- CVE-2025-11096Medium
A flaw was found in D-Link DIR-823X 250416, involving command injection in /goform/diag_traceroute. Manipulation of target_addr allows remote command execution. The exploit is published.
- CVE-2025-11095Medium
A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Manipulation of the argument delvalue results in command injection. Remote exploitation is possible, and the exploit is now public.
- CVE-2025-11092Medium
A weakness was identified in D-Link DIR-823X 250416, involving command injection in function sub_412E7C of /goform/set_switch_settings. Manipulation of port allows remote command execution. The exploit is publicly available.
- CVE-2025-10814Medium
A vulnerability was found in D-Link DIR-823X (versions 240126/240802/250416) in an unknown functionality of /usr/sbin/goahead. Manipulation of the port argument leads to command injection. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2025-10634Medium
A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminal_addr/server_ip/server_port causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
Original NVD description (English source)
A security flaw has been discovered in D-Link DIR-823X up to 20250416. This affects the function sub_415028 of the file /goform/set_wan_settings. The manipulation of the argument ppp_username results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS