D-Link DIR-823G CVE-2026-11492

Exploitation requires an authenticated session with low-level privileges on the D-Link DIR-823G (PR:L per CVSS vector) - unauthenticated remote exploitation is not possible. The target device must be running firmware version 1.0.2B05 with the vsftpd FTP service active and accessible over the network (AV:N). Exploitation is limited by the requirement for prior authentication: an attacker must have valid credentials for the device, either through credential theft, brute force, or use of default credentials. The integrity impact is constrained to the vsftpd configuration scope (I:L, S:U), meaning exploitation does not directly yield full device compromise in a single step. No special non-default configuration beyond vsftpd being enabled is indicated as a prerequisite.

The overall real-world risk is moderate-to-low despite the public POC. CVSS 4.3 (Medium) is consistent with the constrained impact: no confidentiality loss (C:N), no availability impact (A:N), only low integrity impact (I:L). PR:L confirms exploitation requires an authenticated session with at least low-level privileges - unauthenticated remote exploitation is NOT possible per the CVSS vector. Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning an authenticated attacker can exploit reliably. The remediation level is RL:X (not defined), indicating no vendor patch has been formally published. Confidence is RC:R (reasonable), meaning the vulnerability details are credible but not yet fully vendor-confirmed. No EPSS score was provided in the source data, limiting probabilistic exploitation forecasting. The absence of a KEV listing and the authenticated-access prerequisite together suggest this is not a widespread opportunistic threat, but poses a real risk in environments where guest or low-privilege FTP user accounts are active on affected routers.

An attacker who has obtained low-privileged authenticated access to the DIR-823G router - for example, via a guest FTP account or a compromised user credential - sends a crafted request or manipulates the /etc/vsftpd.conf configuration file to alter FTP service behavior beyond their authorized privilege level. A publicly available proof-of-concept has been released (referenced at the Notion link in the VulDB submission), lowering the skill bar for exploitation. The attacker could potentially reconfigure FTP settings to redirect access, alter permission scopes, or enable features that facilitate further compromise of the device or connected network.