The flaw allows an attacker to inject operating‑system commands through the ac_server parameter of the /goform/set_ac_server endpoint in the router’s web management interface. By supplying a specially crafted value, the attacker can cause the device to execute arbitrary shell commands, potentially leading to full compromise of the device, data exfiltration, or service disruption.

The vulnerability affects D‑Link DIR‑823X routers running firmware version 250416. Any unit operating this firmware is susceptible if the web management interface is reachable from an untrusted network.

The CVSS score of 5.1 indicates a moderate impact and the EPSS score of less than 1 % reflects a very low but non‑zero exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog and a public exploit has been released, meaning attackers could mount the attack remotely by sending HTTP requests to the vulnerable endpoint. Successful exploitation requires only network access to the router’s management interface and does not need local privileges.