CVE-2025-14208
BaseFortify
Publication date: 2025-12-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-823x_firmware | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic or HTTP requests to the /goform/set_wan_settings endpoint on the D-Link DIR-823X router. Specifically, look for suspicious or malformed ppp_username parameters that may contain command injection payloads. Since a public proof-of-concept exploit is available, you can use it to test if your device is vulnerable. However, no specific detection commands are documented. It is recommended to analyze logs for unusual commands or unexpected behavior related to WAN settings changes. [1]
Can you explain this vulnerability to me?
This vulnerability is a security flaw in the D-Link DIR-823X router up to version 20250416. It exists in the function sub_415028 of the file /goform/set_wan_settings, where the argument ppp_username can be manipulated to perform command injection. This means an attacker can remotely execute arbitrary commands on the device by exploiting this flaw.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to inject and execute arbitrary commands on the affected device, potentially leading to unauthorized control over the router. This can result in compromised network security, data interception, disruption of network services, or further attacks on connected devices.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected D-Link DIR-823X device with an alternative product, as no known mitigations or countermeasures have been documented. Additionally, restrict remote access to the router's management interface to trusted networks only, and monitor for any suspicious activity. Applying any vendor patches if released should also be considered, but as of the latest information, no patches are available. [1]