A vulnerability exists in the D‑Link DIR‑823X router firmware version 250416 where manipulating the arguments of the /goform/set_static_route_table function allows an attacker to inject arbitrary operating‑system commands. The flaw derives from insufficient validation of the interface, destination address, netmask, gateway, and metric parameters. A remote user could exploit this issue. The CVE documentation does not specify whether authentication is required, so the authentication requirement remains uncertain.

Affected systems are D‑Link DIR‑823X routers running firmware build 250416. No additional product or version information is provided beyond this specific firmware.

The CVSS base score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the current environment. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote through the device’s web management interface. The CVE documentation does not clarify whether an authenticated session is required, so the authentication requirement remains uncertain. An attacker only needs to craft a malicious request to the /goform/set_static_route_table endpoint to trigger command execution.