Bedivere

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-823X versions 240126, 240802, and 250416 **Description** A weakness exists in the Environment Variable Handler component of the D-Link DIR-823X router. Manipulation of the `terminal addr`, `server ip`, or `server port` argument within the `sub 412E7C` function of the `/usr/sbin/goahead` file can lead to command injection. This issue can be exploited remotely. The exploit has been made publicly available. **Recommendations** D-Link DIR-823X version 240126: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-823X version 240802: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-823X version 250416: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-823x versions up to 250416 **Description** A command injection issue exists in D-Link DIR-823x firmware. The issue is located in an unknown function within the `/goform/diag ping` file. Manipulation of the `target addr` argument allows for command injection. Remote exploitation is possible. The exploit is publicly available. **Recommendations** Versions up to 250416: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC20 version 16.03.08.05 **Description** A stack-based buffer overflow exists due to the manipulation of the `wanMTU` argument in the file `/goform/fromAdvSetMacMtuWan`. Remote exploitation is possible. The exploit has been made publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.