D-Link DIR-823X routers are vulnerable to remote OS command injection, posing a severe risk of full system compromise.

This vulnerability is an OS command injection flaw (CWE-78) located within the sub_4208A0 function of the /goform/set_dmz endpoint. An attacker with high privileges can manipulate the dmz_host or dmz_enable arguments to execute arbitrary system commands on the device.

The ability to execute arbitrary commands on a network device allows an attacker to gain full administrative control, potentially leading to total loss of confidentiality, integrity, and availability. With a CVSS score of 7.2, this high severity vulnerability represents a significant threat to internal network security, as compromised routers can be used as persistent entry points for lateral movement or traffic interception.

Immediate Action: Since no official patch version is currently identified, administrators should restrict access to the web management interface to trusted IP addresses only and disable the DMZ feature if it is not strictly required.

Proactive Monitoring: Review system logs for suspicious activity originating from the /goform/set_dmz endpoint and monitor for unexpected outbound traffic from the router to unknown external hosts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter or block requests containing malicious command patterns directed at the /goform/set_dmz URI.

Public Exploit Available: Yes, a published proof of concept exists, as documented in the technical write up at https://github.com/master-abc/cve/issues/32.

Given the availability of a public proof of concept and the high severity of command injection, immediate action is required to harden affected D-Link devices. Administrators must prioritize restricting management access and monitoring for signs of unauthorized interaction with the vulnerable configuration endpoint until the vendor provides a firmware update.