A critical OS command injection vulnerability in D-Link DIR-823X routers allows remote attackers with administrative access to execute arbitrary system commands.

This is an OS command injection flaw (CWE-78) triggered by manipulating the terminal_addr, server_ip, or server_port arguments in the /goform/set_server_settings endpoint. The vulnerability requires administrative privileges (PR:H) to reach the configuration handler, but it can be initiated remotely.

The ability to inject arbitrary OS commands into network infrastructure devices poses a severe threat to internal network security. Successful exploitation could grant an attacker full control over the router, facilitating man-in-the-middle attacks, lateral movement into the internal network, or the permanent compromise of gateway traffic. Given the CVSS score of 7.2, this vulnerability represents a high-severity risk that could lead to complete loss of confidentiality, integrity, and availability for the affected device.

Immediate Action: Disconnect affected devices from the public internet immediately and check the official D-Link support portal for available firmware updates.

Proactive Monitoring: Review device access logs for suspicious entries originating from administrative accounts, particularly those targeting the /goform/set_server_settings path.

Compensating Controls: Restrict administrative access to the device management interface to specific, trusted internal IP addresses or a dedicated management VLAN to prevent unauthorized remote access.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Due to the nature of command injection on network gateway hardware, this vulnerability must be treated with high priority. Organizations using the D-Link DIR-823X must verify their current firmware version and apply the manufacturer's patch as soon as it becomes available. In the interim, ensure that the administrative interface is not exposed to the public internet to mitigate the risk of remote exploitation.