EUVD-2026-35023
GHSA-rhp9-667x-7qvw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Least privilege violation in D-Link DIR-823G firmware version 1.0.2B05 exposes the vsftpd FTP daemon configuration file (/etc/vsftpd.conf) to manipulation by network-accessible, low-privileged authenticated users, enabling unauthorized modification of FTP service behavior. The CVSS vector (AV:N/AC:L/PR:L/UI:N/I:L) confirms this is remotely exploitable with low complexity by any authenticated user, resulting in limited integrity impact. A publicly available proof-of-concept exploit has been released per VulDB reporting (E:P), though no active exploitation has been confirmed in CISA KEV at this time.
Technical ContextAI
The D-Link DIR-823G is a consumer-grade wireless router running embedded Linux firmware. The affected component is vsftpd (Very Secure FTP Daemon), a widely used FTP server, whose configuration is stored in /etc/vsftpd.conf. CWE-272 (Least Privilege Violation) indicates the vulnerability root cause is that a process or user is granted more permissions than necessary - in this context, an authenticated low-privileged user can interact with or manipulate the vsftpd configuration file in ways that should be restricted to administrative roles only. The CPE string cpe:2.3:a:d-link:dir-823g:*:*:*:*:*:*:*:* uses a version wildcard, suggesting NVD/VulDB has not bounded the affected version range beyond what the description states (1.0.2B05). The discrepancy between the 'Information Disclosure' tag applied by VulDB and the CVSS confidentiality impact of C:N warrants attention - the actual scored impact is integrity-only (I:L), meaning the tag may reflect CWE classification nuance or analyst tagging rather than a confirmed data exposure pathway.
RemediationAI
No vendor-released patch has been identified for this vulnerability at time of analysis - the remediation level in the CVSS vector is RL:X (undefined), and no D-Link advisory was found at https://www.dlink.com/. As a compensating control, administrators should disable the vsftpd FTP service entirely on the DIR-823G if FTP functionality is not required, which eliminates the attack surface for this vulnerability but removes FTP access. If FTP must remain active, restrict FTP access to trusted IP addresses only through the router's access control features and ensure no guest or low-privileged user accounts are provisioned on the FTP service. Additionally, placing the device behind a network boundary that blocks inbound FTP connections (TCP port 21) from untrusted networks reduces remote exploitability. Monitor VulDB (https://vuldb.com/vuln/369112) and the D-Link security portal for any firmware update addressing this issue.
Same weakness CWE-272 – Least Privilege Violation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today