The vulnerability is a command injection flaw in the sub_412E7C function that processes the wd_enable argument on the /goform/set_wifidog_settings interface of the D-Link DIR‑823X router. By injecting crafted payloads, an attacker can execute arbitrary shell commands on the device, potentially gaining full control and enabling further malicious actions such as data exfiltration, network pivoting, or device compromise.

All D‑Link DIR‑823X routers running firmware build 250416 contain this issue. The vulnerability appears in the hardware model DIR‑823X and any firmware version that includes the vulnerable sub_412E7C code. Affected customers are those using the 250416 firmware revision.

The vulnerability scores 6.9 on the CVSS scale and has an EPSS score of less than 1 %, indicating a very low probability of widespread exploitation at present. The flaw is remotely exploitable, meaning an attacker only needs internet connectivity to reach the router’s management interface. Although publicly available exploits exist, the low exploitation probability suggests that attackers may have not yet widely deployed this vector. The vulnerability is not listed in the CISA KEV catalog, but it remains a potential threat for privileged network devices.