Skip to main content
IMMUNITYSEC

CVE-2026-2143

D-Link DIR-823X DDNS Service set_ddns os command injection

8.6
HIGH
CVSS 4.0
EPSS 5.0% · 92nd pctCWE-78CWE-77
2026-02-08•Updated 2026-02-23

Description

A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddns of the component DDNS Service. The manipulation of the argument ddnsType/ddnsDomainName/ddnsUserName/ddnsPwd leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Severity

CVSS 4.0 · CNA8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1 · CNA7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CVSS 3.0 · CNA7.2 HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CVSS 2.0 · CNA8.3 HIGH
AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
SSVC · CISA-ADP
Exploitationpoc
Automatableno
Technical impacttotal

Affected Products

VendorProductAffected versions
D-LinkDIR-823X
250416

References

5 Links

Record Details

Published
2026-02-08
Last updated
2026-02-23
Assigner (CNA)
VulDB
Credited to
jiefengliang (VulDB User)

More from D-Link

All D-Link CVEs→
CVE-2025-296357.2

D-Link DIR-823X Command Injection Vulnerability

CVE-2026-11257.5

D-Link DIR-823X set_wifidog_settings sub_412E7C command injection

CVE-2026-21428.6

D-Link DIR-823X set_qos sub_420688 os command injection

CVE-2026-20815.8

D-Link DIR-823X set_password os command injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.