Executive Summary

CVE-2026-2129 is a critical remote OS command injection vulnerability found in the D-Link DIR-823X router, version 250416. It affects the /goform/set_ac_status endpoint, where three parameters—ac_ipaddr, ac_ipstatus, and ap_randtime—are improperly sanitized. Specifically, the input filtering fails to block newline characters, allowing an authenticated attacker to inject arbitrary shell commands. These commands are executed with root privileges when the system commits configuration changes and restarts the capwap service. The vulnerability corresponds to CWE-78 and can be exploited remotely with authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can severely impact the confidentiality, integrity, and availability of the affected device. An attacker who successfully exploits it can execute arbitrary commands with root privileges on the router remotely after authentication. This could lead to unauthorized control over the device, disruption of network services, data theft, or further compromise of the network infrastructure.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the /goform/set_ac_status endpoint on the D-Link DIR-823X router for command injection via the parameters ac_ipaddr, ac_ipstatus, or ap_randtime.'}, {'type': 'paragraph', 'content': 'A proof-of-concept (PoC) exploit is available that performs authentication using HMAC-SHA256 hashed passwords with a session token, then injects commands through these parameters.'}, {'type': 'paragraph', 'content': 'The PoC includes a test mode that verifies the vulnerability by injecting a sleep command and measuring response delays, which can be used as a detection method.'}, {'type': 'list_item', 'content': "Use the PoC Python script to authenticate and inject a benign command such as 'sleep 5' to observe delayed responses indicating vulnerability."}, {'type': 'list_item', 'content': 'Manually send HTTP POST requests to /goform/set_ac_status with manipulated parameters containing newline characters to test for command injection.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Currently, no known countermeasures or official patches are available for this vulnerability.

Suggested mitigations include implementing strict input validation and sanitization on the vulnerable parameters.

• Apply strict regex-based whitelisting for the ac_ipaddr parameter, for example, allowing only valid IP addresses matching ^[0-9.]{7,15}$.
• Explicitly sanitize or reject inputs containing ASCII control characters, especially newline (0x0A) and carriage return (0x0D) characters.
• Avoid using shell command concatenation by replacing system() calls with direct API calls and execve() with fixed argument lists to prevent shell parsing vulnerabilities.

If possible, replace the affected product with an alternative device not vulnerable to this issue.

Useful 0 Not Useful 0