PT-2025-36565 · D Link · Dir-823

Qmssdxn · Published 2025-09-02 · Updated 2025-09-14 · CVE-2025-10123

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X versions up to 250416

Description A vulnerability exists in D-Link DIR-823X routers that allows for remote command injection. The vulnerability is located in the sub 415028 function of the /goform/set static leases file. Manipulation of the Hostname argument can lead to command injection, potentially granting unauthenticated attackers full device control. The exploit for this issue has been publicly disclosed.

Recommendations D-Link DIR-823X versions up to 250416: Update the firmware to address the vulnerability. D-Link DIR-823X versions up to 250416: Disable WAN administration access. D-Link DIR-823X versions up to 250416: Restrict management access to the LAN.

Exploit

Fix

RCE

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BDU:2025-11534

CVE-2025-10123

Affected Products

Dir-823

References · 17

• 🔥 https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md#poc · Exploit
• 🔥 https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-10123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10123 · Security Note
• https://bdu.fstec.ru/vul/2025-11534 · Security Note
• https://twitter.com/CVEnew/status/1965255296273780924 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965264381626683565 · Twitter Post
• https://twitter.com/BaseFortify/status/1965354812469641468 · Twitter Post
• https://vuldb.com/?id.323093 · Note
• https://vuldb.com/?submit.645712 · Note
• https://dlink.com · Note
• https://twitter.com/cracbot/status/1967181600959180829 · Twitter Post
• https://t.me/cveNotify/134733 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1965262907916104041 · Twitter Post
• https://t.me/CVEtracker/32038 · Telegram Post