VulnerabilityAnalyzed
CVE-2026-2084
A weakness has been identified in D-Link DIR-823X 250416.
HIGH 7.3EPSS 4.00%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.00%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A weakness has been identified in D-Link DIR-823X 250416. This impacts an unknown function of the file /goform/set_language. Executing a manipulation of the argument langSelection can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
- CVSS 4.0
- 7.3 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 4.00% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77, CWE-78
- Affected
- dlink/dir-823x firmware
- Source
- cna@vuldb.com
References
- https://github.com/master-abc/cve/issues/24Exploit, Issue Tracking
- https://vuldb.com/?ctiid.344651Permissions Required, VDB Entry
- https://vuldb.com/?id.344651Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.746379Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.746380Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.