The flaw exists in the /goform/set_ac_status API of the D-Link DIR-823X router when the parameters ac_ipaddr, ac_ipstatus, or ap_randtime are supplied with crafted values. These inputs are not properly sanitized, allowing an attacker to inject arbitrary operating system commands. If successful, the attacker could execute code with the privileges of the router, potentially gaining full control over the device and the network segment it serves. The weakness is categorized as CWE‑77 and CWE‑78 – command injection and OS command execution.

The affected hardware is the D-Link DIR‑823X router running firmware version 250416. No additional versions are specified as vulnerable in the CNA data, so only this build should be investigated and remedied.

Scored with a CVSS base of 8.6, the vulnerability is considered critical. The EPSS score is below 1 %, indicating a very low projected exploitation probability at this time. However, the exploit has already been made public and the router is exposed to remote management by default, making the risk more acute for exposed installations. The vulnerability is not yet listed in the CISA KEV catalog, but administrators should treat it as high risk until a vendor patch is applied.