The vulnerability resides in the set_mac_clone function of the DIR-823X firmware 250416. By sending a crafted mac argument to /goform/set_mac_clone, an attacker can inject arbitrary OS commands, resulting in remote code execution on the device.

Affected are D-Link DIR-823X routers running firmware 250416. The flaw lies in the set_mac_clone endpoint and is specific to this firmware version. No other D-Link models or firmware versions are known to be impacted at this time.

The CVSS score of 5.1 indicates moderate severity. EPSS <1% suggests a low probability of exploitation in the general population. However the exploit is publicly available, so targeted attacks are possible. The vulnerability is accessed via remote HTTP requests, implying the network accessible device is the attack vector. Since the flaw allows arbitrary command execution, the potential impact is full compromise of the router, including network traffic interception, traffic manipulation, and lateral movement into the local network.