CVE-2026-1685
Authentication Bypass in D-Link DIR-823X Login Component
Publication date: 2026-01-30
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-823x_firmware | 250416 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
| CWE-799 | The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
There are no known official countermeasures or patches available for this vulnerability. Immediate mitigation steps include considering replacement of the affected D-Link DIR-823X router, restricting remote access to the login interface if possible, and monitoring for brute-force attempts. Users should also ensure that default weak credentials are changed to strong passwords to reduce risk. [2, 3]
Can you explain this vulnerability to me?
This vulnerability affects the D-Link DIR-823X router (firmware version 250416) in its login authentication function sub_40AC74. It allows remote attackers to perform brute-force attacks by exploiting insufficient restrictions on excessive authentication attempts. The router lacks proper rate-limiting and anti-brute-force protections, enabling attackers to repeatedly try to guess login credentials without prior authentication. Although the attack is complex and exploitability is difficult, a public proof-of-concept exploit is available. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized administrative access to the affected router by allowing attackers to perform brute-force login attempts remotely. This compromises the confidentiality of the device, potentially allowing attackers to control or manipulate the router. Since no known mitigations or patches exist, the risk remains until the device is replaced or secured by other means. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for automated brute-force login attempts targeting the /goform/login endpoint of the D-Link DIR-823X router firmware version 250416. Detection may involve analyzing logs for repeated failed authentication attempts or unusual traffic patterns to this endpoint. However, no specific detection commands or tools are provided in the available resources. [1, 2, 3]