SB2025091756 - Multiple vulnerabilities in D-Link DIR-823X

Main Vulnerability Database SB2025091756

SB2025091756 - Multiple vulnerabilities in D-Link DIR-823X

Published: September 17, 2025 Updated: October 1, 2025

Security Bulletin ID SB2025091756

CSH Severity

High

Patch available

NO

Number of vulnerabilities 10

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 10 vulnerabilities.

1) Command Injection (CVE-ID: CVE-2025-10123)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the sub_415028 function in the /goform/set_static_leases file. A remote attacker can pass specially crafted data to the application and execute arbitrary commands.

2) Command Injection (CVE-ID: CVE-2025-10401)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation within an unknown function of the file /goform/diag_ping. A remote user can pass specially crafted data to the application and execute arbitrary commands.

3) Command Injection (CVE-ID: CVE-2025-11095)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the /goform/delete_offline_device file. A remote user can pass specially crafted data to the application and execute arbitrary commands.

4) Command Injection (CVE-ID: CVE-2025-11097)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the /goform/set_device_name file. A remote user can pass specially crafted data to the application and execute arbitrary commands.

5) Command Injection (CVE-ID: CVE-2025-11092)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the "sub_412E7C" function of the file /goform/set_switch_settings. A remote user can pass specially crafted data to the application and execute arbitrary commands.

6) Command Injection (CVE-ID: CVE-2025-10634)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the "sub_412E7C" function of the /usr/sbin/goahead file of the component Environment Variable Handler. A remote user can pass specially crafted data to the application and execute arbitrary commands.

7) Command Injection (CVE-ID: CVE-2025-10814)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the /usr/sbin/goahead file. A remote user can pass specially crafted data to the application and execute arbitrary commands.

8) Command Injection (CVE-ID: CVE-2025-11100)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the uci_set function of the file /goform/set_wifi_blacklists. A remote user can pass specially crafted data to the application and execute arbitrary commands.

9) Command Injection (CVE-ID: CVE-2025-11098)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the /goform/set_wifi_blacklists file. A remote user can pass specially crafted data to the application and execute arbitrary commands.

10) Command Injection (CVE-ID: CVE-2025-11096)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in the /goform/diag_traceroute file. A remote user can pass specially crafted data to the application and execute arbitrary commands.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References