PT-2026-6943 · D Link · D-Link Dir-823G

Jiefengliang · Published 2026-01-24 · Updated 2026-02-13 · CVE-2026-2129

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416

Description A flaw exists in D-Link DIR-823X version 250416 related to the processing of input for the file /goform/set ac status. Manipulation of the ac ipaddr, ac ipstatus, and ap randtime arguments can lead to os command injection. This issue can be exploited remotely. The exploit has been publicly released.

Recommendations Apply any available updates to address the vulnerability in the affected file /goform/set ac status. As a temporary workaround, restrict access to the /goform/set ac status file to minimize the risk of exploitation. Avoid manipulating the ac ipaddr, ac ipstatus, and ap randtime arguments.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2026-02472

CVE-2026-2129

Affected Products

D-Link Dir-823G

References · 13

• 🔥 https://github.com/master-abc/cve/issues/23 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2129 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2129 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02472 · Security Note
• https://twitter.com/RedPacketSec/status/2020374793413894242 · Twitter Post
• https://twitter.com/CVEnew/status/2020356546157256932 · Twitter Post
• https://t.me/CVEtracker/44074 · Telegram Post
• https://dlink.com · Note
• https://vuldb.com/?ctiid.344764 · Note
• https://twitter.com/cracbot/status/2022264545046339958 · Twitter Post
• https://t.me/cveNotify/151274 · Telegram Post
• https://vuldb.com/?submit.746935 · Note
• https://vuldb.com/?id.344764 · Note