The vulnerability resides in the sub_4211C8 routine of the /goform/set_filtering endpoint on D‑Link DIR‑823X firmware 250416. Improper handling of the filtering parameters allows an attacker to inject arbitrary shell commands. An attacker who successfully exploits the flaw can execute any operating‑system commands with the privileges of the router’s firmware, potentially taking full control of the device and the network segment it monitors.

The affected product is the D‑Link DIR‑823X router running firmware version 250416. No other versions or hardware revisions are listed as vulnerable in the current advisory.

The CVSS v3.1 score is 8.6, reflecting a high severity attack that can be carried out remotely with no authentication. However, the EPSS score is below 1%, indicating that, as of the latest data, the probability of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, so no known public exploits are reported yet. Exploitation requires remote access to the router’s web administration interface and sufficient input to the set_filtering endpoint; no specialized hardware or local privileges are needed.