CVE-2025-11092
BaseFortify
Publication date: 2025-09-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-823x_firmware | 250416 |
| dlink | dir-823x | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11092 is a command injection vulnerability in the D-Link DIR-823X router, firmware version V250416. It occurs due to insufficient validation of the 'port' parameter in the HTTP POST request to the endpoint /goform/set_switch_settings. This allows an attacker to inject and execute arbitrary system commands remotely on the device without authentication. The vulnerability arises because the input is improperly handled and passed to a system command execution function, enabling remote code execution. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can allow remote attackers to execute arbitrary commands on the affected D-Link DIR-823X router, compromising the device's confidentiality, integrity, and availability. An attacker can gain unauthorized control over the router, potentially leading to network disruption, data interception, or further attacks on connected devices. Since exploitation requires no local access or authentication, it poses a high security risk. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests targeting the path `/goform/set_switch_settings` with unusual or malicious payloads in the "port" parameter. A practical detection method is to capture and analyze network traffic for POST requests to this endpoint. For example, using tools like curl or wget to test the endpoint with benign and malicious inputs can help identify if the device is vulnerable. Additionally, network intrusion detection systems (NIDS) can be configured to alert on HTTP POST requests containing suspicious command injection patterns targeting `/goform/set_switch_settings`. A sample command to test might be: curl -X POST http://<router-ip>/goform/set_switch_settings -d "port=;id;" This sends a command injection attempt by injecting the `id` command. If the device executes this, it indicates vulnerability. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the affected device's management interface to trusted networks only, such as limiting HTTP POST access to `/goform/set_switch_settings` from internal or secure IP ranges. Since no known patches or countermeasures are available, it is recommended to replace the affected D-Link DIR-823X device with an alternative product that is not vulnerable. Additionally, disabling remote management or blocking HTTP POST requests to the vulnerable endpoint can reduce exposure. Monitoring for exploitation attempts and isolating affected devices until replacement is also advised. [2]