A critical OS command injection vulnerability in D-Link DIR-823X routers enables remote attackers to execute arbitrary commands, posing a severe risk of total system compromise.

This vulnerability involves an OS command injection flaw within the /goform/set_ac_status file. By manipulating the ac_ipaddr, ac_ipstatus, or ap_randtime parameters, an authenticated attacker with high privileges can execute arbitrary commands on the underlying operating system.

The ability to execute arbitrary OS commands on a network device represents a critical security failure, potentially granting an attacker full control over the router. This allows for unauthorized network traffic interception, internal network pivoting, or complete loss of service. Given the CVSS score of 7.2, this vulnerability must be treated with high urgency to prevent unauthorized administrative access and potential data exfiltration.

Immediate Action: As no official patch is currently listed, administrators should restrict network access to the management interface of affected devices to trusted subnets only. If possible, disable the impacted service or implement strict egress filtering to prevent the router from initiating unauthorized outbound connections.

Proactive Monitoring: Monitor device logs for unusual activity associated with the /goform/set_ac_status endpoint or unexpected process execution. Check for unauthorized configuration changes that may indicate successful exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or an intrusion detection system to monitor and block malicious HTTP requests containing command injection patterns targeting the specified parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/master-abc/cve/issues/23.

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Network administrators should prioritize isolating affected D-Link devices from the public internet immediately and continue monitoring vendor channels for an official firmware update. Failure to mitigate this exposure may result in full device takeover by unauthorized parties.