Skip to content
OpenAdvisories
Medium WID-SEC-2026-0340 14 CVEs

D-LINK DIR-823X und DWR-M921 Router: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten

Published Feb 8, 2026 · Updated Feb 8, 2026 · de-DE

Vendor: D-Link Product: Router

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in D-LINK Router ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

Product

Router der Firma D-LINK enthalten eine Firewall und in der Regel eine WLAN-Schnittstelle. Die Geräte sind hauptsächlich für private Anwender und Kleinunternehmen konzipiert.

Vulnerabilities 14

  • High 7.2
    CVE-2026-2084

    D-Link DIR-823X set_language os command injection

    A weakness has been identified in D-Link DIR-823X 250416. This impacts an unknown function of the file /goform/set_language. Executing a manipulation of the argument langSelection can lead to os command injection. It is possible to launch the attack remotely.…

    D-Link DIR-823X Network devices
  • High 7.2
    CVE-2026-2085 EPSS 11%

    D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection

    A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component USSD Configuration Endpoint. The manipulation of the argument ussdValue leads to command injection. Th…

    D-Link DWR-M921 Network devices
  • High 7.2
    CVE-2026-2120

    D-Link DIR-823X Configuration Parameter set_server_settings os command injection

    A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the component Configuration Parameter Handler. The manipulation of the argument terminal_addr/server_ip/server_port leads to …

    D-Link DIR-823X Network devices
  • High 7.2
    CVE-2026-2129

    D-Link DIR-823X set_ac_status os command injection

    A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/set_ac_status. Performing a manipulation of the argument ac_ipaddr/ac_ipstatus/ap_randtime results in os command injection. The attac…

    D-Link DIR-823X Network devices
  • High 7.2
    CVE-2026-2142

    D-Link DIR-823X set_qos sub_420688 os command injection

    A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made…

    D-Link DIR-823X Network devices
  • High 7.2
    CVE-2026-2143

    D-Link DIR-823X DDNS Service set_ddns os command injection

    A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddns of the component DDNS Service. The manipulation of the argument ddnsType/ddnsDomainName/ddnsUserName/ddnsPwd leads to…

    D-Link DIR-823X Network devices
  • High 7.2
    CVE-2026-2155

    D-Link DIR-823X Configuration set_dmz sub_4208A0 os command injection

    A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz of the component Configuration Handler. The manipulation of the argument dmz_host/dmz_enable results in os command injec…

    D-Link DIR-823X Network devices
  • High 7.2
    CVE-2026-2157

    D-Link DIR-823X set_static_route_table sub_4175CC os command injection

    A security vulnerability has been detected in D-Link DIR-823X 250416. This affects the function sub_4175CC of the file /goform/set_static_route_table. Such manipulation of the argument interface/destip/netmask/gateway/metric leads to os command injection. The…

    D-Link DIR-823X Network devices
  • High 7.2
    CVE-2026-2175

    D-Link DIR-823X set_upnp sub_420618 os command injection

    A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. This manipulation of the argument upnp_enable causes os command injection. Remote exploitation of the attack is possible…

    D-Link DIR-823X Network devices
  • High 7.2
    CVE-2026-2210

    D-Link DIR-823X set_filtering sub_4211C8 os command injection

    A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipulation leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the publi…

    D-Link DIR-823X Network devices
  • Medium 4.7
    CVE-2026-2061

    D-Link DIR-823X set_ipv6 sub_424D20 os command injection

    A vulnerability was determined in D-Link DIR-823X 250416. Affected by this issue is the function sub_424D20 of the file /goform/set_ipv6. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has …

    D-Link DIR-823X Network devices
  • Medium 4.7
    CVE-2026-2063

    D-Link DIR-823X Web Management set_ac_server os command injection

    A security flaw has been discovered in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/set_ac_server of the component Web Management Interface. The manipulation of the argument ac_server results in os command injection. The…

    D-Link DIR-823X Network devices
  • Medium 4.7
    CVE-2026-2081

    D-Link DIR-823X set_password os command injection

    A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of the argument http_passwd causes os command injection. The attack is possible to be carried out remotel…

    D-Link DIR-823X Network devices
  • Medium 4.7
    CVE-2026-2082

    D-Link DIR-823X set_mac_clone os command injection

    A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/set_mac_clone. Such manipulation of the argument mac leads to os command injection. The attack may be performed from remote. The exploit …

    D-Link DIR-823X Network devices

Revision history

  1. #1

    Initiale Fassung

References