PT-2026-6988 · D Link · Dir-823

Jiefengliang · Published 2026-01-27 · Updated 2026-02-08 · CVE-2026-2157

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416

Description A security issue exists in D-Link DIR-823X version 250416. The sub 4175CC function within the /goform/set static route table file is susceptible to OS command injection. Manipulation of the interface, destip, netmask, gateway, and metric arguments can lead to unauthorized command execution. This can be exploited remotely. The exploit has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2026-02470

CVE-2026-2157

Affected Products

Dir-823

References · 11

• 🔥 https://github.com/master-abc/cve/issues/28 · Exploit
• https://bdu.fstec.ru/vul/2026-02470 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2157 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2157 · Vendor Advisory
• https://vuldb.com/?id.344859 · Note
• https://vuldb.com/?submit.748376 · Note
• https://t.me/cveNotify/151303 · Telegram Post
• https://dlink.com · Note
• https://t.me/CVEtracker/44106 · Telegram Post
• https://twitter.com/CVEnew/status/2020518487530041586 · Twitter Post
• https://vuldb.com/?ctiid.344859 · Note