Description
A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-02-08
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the sub_420688 routine of the /goform/set_qos handler in D‑Link DIR‑823X firmware 250416. An attacker who can send a crafted request to this endpoint can inject arbitrary operating‑system commands, leading to full remote code execution on the device. This bypasses input validation (CWE‑77, CWE‑78) and compromises confidentiality, integrity, and availability.

Affected Systems

Affected devices are D‑Link DIR‑823X routers running firmware image 250416. No other firmware revisions are listed as impacted, but the CVE references enumerate this specific build.

Risk and Exploitability

The CVSS score of 8.6 indicates a high risk, and although the EPSS score is shown as less than 1%, an exploit has already been publicly released, making the threat real. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit it remotely via the router’s web interface by sending a crafted request to the /goform/set_qos endpoint, bypassing authentication and input validation.

Generated by OpenCVE AI on April 17, 2026 at 21:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update that fixes the command injection issue.
  • If no update is available, restrict access to the router’s web administration interface to trusted IP addresses or disable remote management.
  • Disable the QoS configuration API or block the /goform/set_qos endpoint using a firewall or access control list.

Generated by OpenCVE AI on April 17, 2026 at 21:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dir-823x
Dlink dir-823x Firmware
CPEs cpe:2.3:h:dlink:dir-823x:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-823x_firmware:250416:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dir-823x
Dlink dir-823x Firmware

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dir-823x
Vendors & Products D-link
D-link dir-823x

Sun, 08 Feb 2026 08:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Title D-Link DIR-823X set_qos sub_420688 os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

D-link Dir-823x
Dlink Dir-823x Dir-823x Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:39:47.978Z

Reserved: 2026-02-06T21:08:25.984Z

Link: CVE-2026-2142

cve-icon Vulnrichment

Updated: 2026-02-10T21:17:47.994Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-08T08:15:53.557

Modified: 2026-02-10T14:57:38.327

Link: CVE-2026-2142

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T22:00:11Z

Weaknesses