PT-2026-6983 · D Link · Dir-823

942384053 · Published 2026-01-26 · Updated 2026-03-09 · CVE-2026-2155

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416

Description A security flaw exists in D-Link DIR-823X version 250416. The issue resides within the Configuration Handler component, specifically in the function sub 4208A0 located in the file /goform/set dmz. Manipulation of the dmz host/dmz enable argument can lead to operating system command injection. This allows for remote execution of commands. The exploit for this issue has been publicly released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2026-02469

CVE-2026-2155

Affected Products

Dir-823

References · 13

• 🔥 https://github.com/master-abc/cve/issues/32 · Exploit
• https://bdu.fstec.ru/vul/2026-02469 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2155 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2155 · Vendor Advisory
• https://t.me/CVEtracker/44104 · Telegram Post
• https://vuldb.com/?id.344857 · Note
• https://dlink.com · Note
• https://vuldb.com/?ctiid.344857 · Note
• https://twitter.com/DavidMarquet19/status/2030916641937088604 · Twitter Post
• https://t.me/cveNotify/151301 · Telegram Post
• https://vuldb.com/?submit.748236 · Note
• https://vuldb.com/?submit.750038 · Note
• https://twitter.com/CVEnew/status/2020499584032838012 · Twitter Post