The vulnerability allows an attacker to inject arbitrary operating system commands through the DDNS configuration interface of the D-Link DIR-823X. By manipulating parameters such as ddnsType, ddnsDomainName, ddnsUserName, and ddnsPwd, the device can execute unintended commands, leading to full compromise of the device’s operating system. This results in a loss of confidentiality, integrity, and availability of the device and any network resources it controls.

The issue is present in the D-Link DIR-823X router running firmware version 250416. No other vendors or product versions are explicitly listed, but the scope appears limited to this specific model and firmware build.

With a CVSS score of 8.6, the severity is high, and the EPSS score indicates a very low yet nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack is reachable remotely via the router’s HTTP interface and typically requires no local access; a threat actor can trigger the injection by sending crafted requests to the /goform/set_ddns endpoint from outside the device’s network. Because it is a direct and straightforward exploitation path, the risk remains significant for any exposed router.