Cyber Posture

CVE-2026-1125

HighPublic PoC

Published: 18 January 2026

Published
18 January 2026
Modified
23 February 2026
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0020 41.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of the argument wd_enable can lead to command injection. The attack can be executed remotely. The…

more

exploit has been made available to the public and could be used for attacks.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by requiring validation of the malicious wd_enable argument in the /goform/set_wifidog_settings endpoint.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the specific command injection flaw in the sub_412E7C function through patching or updates.

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Limits unauthenticated actions on sensitive endpoints like /goform/set_wifidog_settings, blocking remote unauthenticated exploitation.

Security SummaryAI

CVE-2026-1125 is a command injection vulnerability affecting the D-Link DIR-823X router on firmware version 250416. The flaw exists in the sub_412E7C function of the /goform/set_wifidog_settings file, where manipulation of the wd_enable argument enables arbitrary command execution. This issue, linked to CWE-74 and CWE-77, was published on 2026-01-18 and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

The vulnerability is exploitable remotely by unauthenticated attackers requiring low complexity and no user interaction. By crafting a malicious request to the affected endpoint, an attacker can inject commands, achieving limited impacts on confidentiality, integrity, and availability of the device.

References include a GitHub repository containing a public exploit for the D-Link DIR-823X v250416 command execution vulnerability, along with VulDB entries detailing the issue (ctiid.341717, id.341717) and submission records. Security practitioners should review these sources for additional technical details, as specific vendor patch or mitigation guidance is not detailed in the core description.

Details

CWE(s)
CWE-74CWE-77

Affected Products

dlink
dir-823x firmware
250126

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

CVE enables exploitation of public-facing web application (T1190) on router via unauthenticated command injection, facilitating arbitrary command execution on network device CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References