Dir 823x Firmware
CVE-2025-55848
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not filtered by '&'to allow injection of reverse connection commands.
AnalysisAI
An issue was discovered in DIR-823 firmware 20250416. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not filtered by '&'to allow injection of reverse connection commands. Affected products include: Dlink Dir-823X Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.
More in Dir 823x Firmware
View allAn issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234. Rated cr
An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the fu
An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and t
An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and t
D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (
A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. Rated high severity (C
An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8. Rated hi
Unauthenticated attackers can execute arbitrary operating system commands on D-Link DIR-823X routers through the /goform
Remote code execution in D-Link DIR-823X routers through OS command injection in the static route configuration endpoint
Remote code execution in D-Link DIR-823X routers through OS command injection in the /goform/set_server_settings endpoin
Remote code execution in D-Link DIR-823X routers through OS command injection in the DMZ configuration handler allows un
D-Link DIR-823X firmware contains a command injection vulnerability in the /goform/set_language endpoint that allows rem
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today