CVE-2026-1125
Remote Command Injection in D-Link DIR-823X WiFiDog Settings
Publication date: 2026-01-18
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| d-link | dir-823x | 250416 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1125 is a critical command injection vulnerability in the D-Link DIR-823X router (version 250416). It exists in the function sub_412E7C within the /goform/set_wifidog_settings file, specifically involving the manipulation of the argument 'wd_enable'. Improper handling of this argument allows an attacker to inject arbitrary commands remotely without any authentication. This means an attacker can execute commands on the router by sending specially crafted requests, potentially gaining control over the device. [1, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to execute arbitrary commands on your D-Link DIR-823X router without authentication. This can compromise the confidentiality, integrity, and availability of the device, potentially leading to unauthorized control, disruption of network services, data theft, or further attacks on your network. Since the exploit is publicly available and easy to execute, the risk is high. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for unusual or unauthorized requests to the /goform/set_wifidog_settings endpoint, specifically those manipulating the wd_enable parameter. Since the exploit allows remote command injection without authentication, network intrusion detection systems (NIDS) can be configured to alert on HTTP requests containing suspicious payloads targeting this endpoint. However, no specific detection commands or signatures are provided in the available resources. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected D-Link DIR-823X router (version 250416) with an alternative device, as no known mitigations or countermeasures currently exist. It is recommended to avoid using the vulnerable device to prevent exploitation. Monitoring for suspicious activity and restricting network access to the device may also help reduce risk until replacement. [1]