A subroutine in the DIR-823X firmware’s /goform/set_ipv6 handler allows an attacker to inject and execute arbitrary operating‑system commands. The flaw is exploitable remotely, yielding full control over the device’s operating system. An attacker could compromise confidentiality, integrity, and availability by modifying system configuration, exfiltrating data, or using the router as a pivot for further attacks.

The vulnerability exists in D-Link’s DIR-823X router running firmware build 250416. No other firmware revisions are known to be impacted.

The CVSS score of 5.1 indicates moderate severity, and the EPSS <1% suggests a low likelihood of exploitation in the wild. The vulnerability is not identified in CISA’s KEV catalog. Based on the description, the likely attack vector is via HTTP access to the device’s web interface and the ability to submit crafted parameters to the /goform/set_ipv6 endpoint. If it is reachable from external networks, an attacker could create a long‑lived backdoor or modify routing tables.