A vulnerability in the DIR-823X firmware 250416 allows an attacker to manipulate the lan_gateway parameter in the /goform/set_mode function, resulting in OS command injection and remote command execution. The flaw is exploitable over the network and an exploit has been publicly released. Successful exploitation would enable an adversary to gain full control of the device, potentially allowing further compromise of the connected network.

D-Link DIR‑823X routers running firmware version 250416, which are no longer supported by the vendor.

The CVSS score of 5.3 indicates a moderate potential for damage, while an EPSS score of less than 1 % suggests low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector is remote HTTP access to /goform/set_mode, requiring the device to be reachable and the vulnerable parameter to be controllable by the attacker.