CVE-2025-10123

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X versions prior to 250416

Description A command injection issue exists in the sub 415028 function within the /goform/set static leases endpoint. The flaw is caused by insufficient input validation of the Hostname variable. A remote attacker can exploit this by sending a specially crafted request to execute arbitrary commands on the device, potentially gaining full control.

Recommendations Update the firmware to a version newer than 250416. Disable WAN administration. Restrict management access to the local area network (LAN).