A critical OS command injection vulnerability in the D-Link DIR-823X router allows remote attackers with administrative access to execute arbitrary commands on the underlying system.

This vulnerability occurs in the sub_4175CC function within the /goform/set_static_route_table file. By manipulating arguments such as interface, destip, netmask, gateway, or metric, a remote attacker with high privileges can perform OS command injection.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary system commands, which can lead to a complete compromise of the router. Given the CVSS score of 7.2, the impact is significant, potentially allowing attackers to pivot into the internal network, intercept traffic, or disrupt critical connectivity services, leading to severe operational downtime and data exposure.

Immediate Action: Since a patch is currently not confirmed, restrict administrative access to the management interface to trusted internal networks only and disable remote management features.

Proactive Monitoring: Monitor system logs for unusual entries in the static route table or unexpected outbound traffic patterns originating from the router.

Compensating Controls: Implement strict firewall rules to block access to the /goform/set_static_route_table endpoint from untrusted or external IP addresses.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub issue.

Given the severity of this command injection flaw and the existence of a public proof-of-concept, immediate action is required to secure the affected D-Link devices. Administrators should ensure that the management interface is not exposed to the internet and monitor for any signs of unauthorized configuration changes until a vendor-supplied firmware update becomes available.