A vulnerability in the D‑Link DIR‑823X router firmware build 250416 allows an attacker to execute arbitrary operating‑system commands by manipulating the langSelection parameter in the /goform/set_language endpoint. The flaw is caused by improper construction of a system command, leading to a classic OS command injection (CWE‑77/78). Because the injection can be triggered by a crafted HTTP request sent to the device’s admin interface, a remote attacker can gain the ability to run arbitrary commands on the router, potentially compromising its operation and internal data.

Affected devices are D‑Link DIR‑823X routers running firmware 250416. No other firmware releases are explicitly identified as vulnerable. The affected endpoint is /goform/set_language.

The CVSS base score of 8.6 places the flaw in the high‑severity category. The EPSS score is below 1 %, indicating a low but non‑zero likelihood of exploitation. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the vulnerability requires only a single crafted request to the device’s administrative interface, an attacker can perform the exploit remotely. Publicly available proof‑of‑concept code is available, demonstrating that the flaw can be leveraged without special prerequisites.