PT-2026-6939 · D Link · Dir-823

942384053 · Publicado 2026-02-08 · Atualizado 2026-02-13 · CVE-2026-2120

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416

Description A flaw exists in the Configuration Parameter Handler component of D-Link DIR-823X version 250416. The issue stems from manipulating the terminal addr, server ip, and server port arguments within the /goform/set server settings file, leading to operating system command injection. This allows for remote attacks. The exploit is publicly available.

Recommendations Apply a firmware update that addresses the vulnerability in the Configuration Parameter Handler component. As a temporary workaround, restrict access to the /goform/set server settings file. Avoid using the terminal addr, server ip, and server port parameters until the issue is resolved.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

CVE-2026-2120

Produtos afetados

Dir-823

Referências · 12

• 🔥 https://github.com/master-abc/cve/issues/26 · Exploit
• https://t.me/CVEtracker/44070 · Publicação no Telegram
• https://twitter.com/RedPacketSec/status/2020374790968635687 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2120 · Nota de Segurança
• https://twitter.com/CVEnew/status/2020356554424279292 · Publicação no Twitter
• https://twitter.com/cracbot/status/2022264539983851928 · Publicação no Twitter
• https://dlink.com · Nota
• https://vuldb.com/?submit.746916 · Nota
• https://osv.dev/vulnerability/CVE-2026-2120 · Aviso do Fabricante
• https://vuldb.com/?id.344694 · Nota
• https://t.me/cveNotify/151269 · Publicação no Telegram
• https://vuldb.com/?ctiid.344694 · Nota