Description
A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-02-08
Score: 8.6 High
EPSS: 5.7% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the sub_420688 routine of the /goform/set_qos handler in D‑Link DIR‑823X firmware 250416. A crafted request to this endpoint can inject arbitrary operating‑system commands, which may lead to full remote code execution on the device and compromise confidentiality, integrity, and availability. The weakness involves improper input handling (CWE‑77, CWE‑78).

Affected Systems

Affected devices are D‑Link DIR‑823X routers running firmware image 250416. No other firmware revisions are listed as impacted, but the CVE references enumerate this specific build.

Risk and Exploitability

The CVSS score of 8.6 indicates a high risk, and although the EPSS score is shown as 6%, an exploit has already been publicly released, making the threat real. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit it remotely by sending a crafted request to the /goform/set_qos endpoint, which results in operating‑system command execution.

Generated by OpenCVE AI on June 18, 2026 at 05:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update that fixes the command injection issue.
  • If no update is available, restrict access to the router’s web administration interface to trusted IP addresses or disable remote management.
  • Disable the QoS configuration API or block the /goform/set_qos endpoint using a firewall or access control list.

Generated by OpenCVE AI on June 18, 2026 at 05:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dir-823x
Dlink dir-823x Firmware
CPEs cpe:2.3:h:dlink:dir-823x:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-823x_firmware:250416:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dir-823x
Dlink dir-823x Firmware

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dir-823x
Vendors & Products D-link
D-link dir-823x

Sun, 08 Feb 2026 08:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Title D-Link DIR-823X set_qos sub_420688 os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

D-link Dir-823x
Dlink Dir-823x Dir-823x Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:39:47.978Z

Reserved: 2026-02-06T21:08:25.984Z

Link: CVE-2026-2142

cve-icon Vulnrichment

Updated: 2026-02-10T21:17:47.994Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-08T08:15:53.557

Modified: 2026-06-17T10:30:23.980

Link: CVE-2026-2142

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T05:15:16Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')