PT-2025-39755 · D Link · D-Link Dir-823G

Maximdevere · Published 2025-09-09 · Updated 2025-09-30 · CVE-2025-11092

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416

Description A flaw exists in the D-Link DIR-823X, specifically within the sub 412E7C function located in the /goform/set switch settings file. Manipulation of the port argument can lead to command injection. This issue can be exploited remotely. The exploit is publicly available.

Recommendations Apply updates to address the flaw in the sub 412E7C function of the /goform/set switch settings file. As a temporary workaround, restrict access to the /goform/set switch settings file to minimize the risk of exploitation. Avoid using the port parameter in the affected function until the issue is resolved.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BDU:2025-12539

CVE-2025-11092

Affected Products

D-Link Dir-823G

References · 12

• 🔥 https://github.com/maximdevere/CVE2/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2025-11092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11092 · Security Note
• https://bdu.fstec.ru/vul/2025-12539 · Security Note
• https://t.me/CVEtracker/33565 · Telegram Post
• https://twitter.com/SecAideInfo/status/1972968387581186215 · Twitter Post
• https://t.me/cveNotify/136725 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1972142063794758075 · Twitter Post
• https://vuldb.com/?submit.661809 · Note
• https://vuldb.com/?ctiid.326174 · Note
• https://dlink.com · Note
• https://vuldb.com/?id.326174 · Note