CVE-2026-1125
Unknown Unknown - Not Provided
Remote Command Injection in D-Link DIR-823X WiFiDog Settings

Publication date: 2026-01-18

Last updated on: 2026-04-29

Assigner: VulDB

Description
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of the argument wd_enable can lead to command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-18
Last Modified
2026-04-29
Generated
2026-06-17
AI Q&A
2026-01-19
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1125
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
d-link dir-823x 250416
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-1125 is a critical command injection vulnerability in the D-Link DIR-823X router (version 250416). It exists in the function sub_412E7C within the /goform/set_wifidog_settings file, specifically involving the manipulation of the argument 'wd_enable'. Improper handling of this argument allows an attacker to inject arbitrary commands remotely without any authentication. This means an attacker can execute commands on the router by sending specially crafted requests, potentially gaining control over the device. [1, 3]

Impact Analysis

This vulnerability can impact you by allowing remote attackers to execute arbitrary commands on your D-Link DIR-823X router without authentication. This can compromise the confidentiality, integrity, and availability of the device, potentially leading to unauthorized control, disruption of network services, data theft, or further attacks on your network. Since the exploit is publicly available and easy to execute, the risk is high. [1, 3]

Detection Guidance

Detection of this vulnerability involves monitoring for unusual or unauthorized requests to the /goform/set_wifidog_settings endpoint, specifically those manipulating the wd_enable parameter. Since the exploit allows remote command injection without authentication, network intrusion detection systems (NIDS) can be configured to alert on HTTP requests containing suspicious payloads targeting this endpoint. However, no specific detection commands or signatures are provided in the available resources. [1, 3]

Mitigation Strategies

Immediate mitigation steps include replacing the affected D-Link DIR-823X router (version 250416) with an alternative device, as no known mitigations or countermeasures currently exist. It is recommended to avoid using the vulnerable device to prevent exploitation. Monitoring for suspicious activity and restricting network access to the device may also help reduce risk until replacement. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart