The vulnerability resides in the sub_420618 routine that processes the upnp_enable argument in the /goform/set_upnp endpoint of the firmware. By inserting malicious payloads into that argument, an attacker can force the device to execute arbitrary OS commands on the router. Only the web interface is required to trigger the flaw, so remote attackers can retrieve or modify the device configuration, install malware, or pivot to downstream network hosts. The weakness is an example of operating system command injection, which affects data confidentiality, integrity, and availability.

Affected devices are the D-Link DIR-823X routers carrying the 250416 firmware build. The flaw has not been reported in other DIR-823X revisions or other D-Link products. There is no publicly known workaround from D-Link; the fix is expected in a future firmware update.

The flaw carries a CVSS v3 base score of 8.6, a very high severity rating, and an EPSS of less than 1 %, indicating it is not widely exploited yet. It is not listed in the CISA KEV catalog. The attack vector is network-based; an unauthenticated attacker who can reach the router's web administration portal can send crafted POST or GET requests to /goform/set_upnp with a malicious upnp_enable value to trigger command execution. Because it does not require privileged credentials, it presents a low barrier to exploitation for any host that can reach the router.