A vulnerability in the DIR-823X router's management interface allows remote attackers to execute arbitrary operating system commands via the /goform/set_password endpoint. By manipulating the http_passwd parameter, an attacker can inject shell commands. The flaw is an OS command injection problem (CWE-77) that can lead to remote code execution, compromising confidentiality, integrity, and availability of the device and the network it serves.

The issue affects D-Link DIR-823X routers running firmware version 250416. The vulnerable functionality resides in the undocumented /goform/set_password handler. All devices with this firmware revision are susceptible; no fixed version is listed in the data.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable interface over the network, making the exploit possible remotely if the router is exposed to the internet or an untrusted local network. While no specific commercial exploit is documented, the publicly disclosed nature of the vulnerability means that attackers could craft custom payloads.