A remote attacker can manipulate the terminal_addr, server_ip, or server_port parameters of the /goform/set_server_settings configuration page to inject operating system commands. This leads to arbitrary command execution on the device, compromising the confidentiality, integrity, and availability of the router and the network it serves. The vulnerability arises from a failure to sanitize user input before passing it to the underlying operating system, classified under CWE‑77 and CWE‑78.

The flaw affects D‑Link DIR‑823X routers running firmware version 250416. Any device in the DIR‑823X family that has not applied the vendor’s update for this firmware version remains vulnerable.

The CVSS score of 8.6 indicates a high severity, while the EPSS value of less than 1% suggests that exploitation is currently rare. The vulnerability can be triggered over the network from a remote host, and publicly documented exploit code exists. The lack of a KEV listing implies it has not yet been identified as a widely observed exploited vulnerability, but the high impact warrants pre‑emptive action.