CVE-2026-15270
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A weakness has been identified in the web interface of D-link DIR-823G router version 1.0.2B05_20181207 in the file /etc/boa/boa.conf. Manipulation of this file can lead to a least privilege violation. The attack can be launched remotely but requires a high level of complexity.
Risk Assessment
The organization is at risk of remote security policy violations, potentially allowing an attacker to gain unauthorized access to sensitive router functions. The publicly available exploit increases the likelihood of exploitation.
Recommendation
It is recommended to immediately update the firmware of the D-link DIR-823G router to the latest available version. If an update is not possible, restrict access to the web interface to trusted networks only.
Other vulnerabilities in D-link DIR-823G
See all- CVE-2020-25368Critical
A command injection vulnerability was discovered in the HNAP1 protocol on D-Link DIR-823G devices running firmware V1.0.2B05. An attacker can remotely execute arbitrary system commands by sending a crafted login request with shell metacharacters in the PrivateLogin field.
- CVE-2020-25366Critical
A vulnerability in the /cgi-bin/upload_firmware.cgi component of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.
- CVE-2020-25367Critical
A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker can remotely execute arbitrary web scripts by sending shell metacharacters in the Captcha field during login.
- CVE-2026-11492Medium
A flaw in D-Link DIR-823G 1.0.2B05 in the vsftpd component allows remote violation of the least privilege principle.
- CVE-2025-60675Medium
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries. The vulnerability occurs because parsed fields from the /tmp/new_qos.rule configuration file are concatenated into command strings and executed via system() without any sanitization.
- CVE-2025-60671Medium
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit file. The vulnerability occurs because content read from this file is only partially validated for a prefix and then formatted using vsnprintf() before being executed with system(), allowing an attacker with write access to /var/system/linux_vlan_reinit to execute arbitrary commands on the device.
Original NVD description (English source)
A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privilege violation. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks.