The vulnerability arises from the sub_40AC74 function in the Login component of the D‑Link DIR‑823X. The code fails to impose the intended limit on repeated authentication attempts, so an attacker can send unlimited login requests. This flaw can be used for brute‑force credential enumeration and possibly for credential stuffing attacks. The description indicates that the attack requires high complexity and is considered difficult, but the exploit is publicly available.

Affected devices are the D‑Link DIR‑823X routers running firmware version 250416. The issue was reported to affect the firmware build identified by the CPE string for dir‑823x_firmware:250416. No other versions or vendor products are specified.

The CVSS base score of 6.3 classifies the vulnerability as medium severity. The EPSS is less than 1 %, suggesting that, at present, the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. The listed attack vector is remote; the attacker exploits the flaw against the router’s web interface. Although the exploit is public, the description notes that the attack has high complexity and is difficult to carry out, which may deter casual adversaries.