The flaw resides in the /goform/set_dmz endpoint of the D‑Link DIR‑823X firmware, where an attacker can manipulate the dmz_host and dmz_enable parameters to execute arbitrary OS commands. This remote command injection allows an adversary to gain full control over the router, compromising confidentiality, integrity, and availability. The vulnerability is a classic case of OS command injection identified by CWE‑77 and CWE‑78.

D‑Link DIR‑823X routers running firmware version 250416 are affected. No other firmware revisions are known to be vulnerable from the data provided.

The vulnerability has a CVSS score of 8.6, indicating high severity, but its EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability has not been listed in CISA’s KEV catalog, and no official fix or workaround has yet been announced by D‑Link. The attack can be performed remotely via the public web interface, requiring only that the attacker reach the router’s /goform/set_dmz endpoint. The existence of a publicly released exploit increases the risk to any device still running the vulnerable firmware.