What is the CVSS score of CVE-2026-2120?

CVE-2026-2120 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dir 823x Firmware are affected by CVE-2026-2120?

A high-severity vulnerability (CVE-2026-2120) affects D-Link DIR-823X routers, enabling attackers to manipulate critical configuration settings through an unauthenticated web interface.

Is there a public PoC exploit available for CVE-2026-2120?

Yes, a public proof-of-concept exploit is available for CVE-2026-2120. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-2120?

Within 24 hours: Identify and inventory all D-Link DIR-823X 250416 devices in production and isolate affected units from critical network segments. Within 7 days: Implement network segmentation to restrict administrative access to these devices, disable remote management features, and monitor for suspicious configuration changes. Within 30 days: Plan device replacement or upgrade to patched firmware versions once available, or evaluate alternative router solutions if D-Link does not release a timely patch.

Dir 823x Firmware CVE-2026-2120

HIGH

Command Injection (CWE-77)

2026-02-08 cna@vuldb.com

D-Link Command Injection Dir 823x Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 11, 2026 - 18:59 vuln.today

Public exploit code

CVE Published

Feb 08, 2026 - 01:16 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the component Configuration Parameter Handler. The manipulation of the argument terminal_addr/server_ip/server_port leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Remote code execution in D-Link DIR-823X routers through OS command injection in the /goform/set_server_settings endpoint allows unauthenticated attackers to execute arbitrary commands by manipulating terminal_addr, server_ip, or server_port parameters. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at high risk.

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects Dir-823X Firmware. A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the component Configuration Parameter Handler. The manipulation of the argument terminal_addr/server_ip/server_port leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.