What is the CVSS score of CVE-2026-2129?

CVE-2026-2129 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dir 823x Firmware are affected by CVE-2026-2129?

A high-severity vulnerability in D-Link DIR-823X routers allows potential unauthorized access to network devices through a vulnerable web interface endpoint.

Is there a public PoC exploit available for CVE-2026-2129?

Yes, a public proof-of-concept exploit is available for CVE-2026-2129. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-2129?

Within 24 hours: Identify and inventory all D-Link DIR-823X 250416 devices in your environment and isolate them from critical network segments if possible. Within 7 days: Implement network segmentation to restrict access to affected router management interfaces and enable access logging. Within 30 days: Contact D-Link for patch availability confirmation; if unavailable, evaluate device replacement or persistent compensating controls.

Dir 823x Firmware CVE-2026-2129

HIGH

Command Injection (CWE-77)

2026-02-08 cna@vuldb.com

D-Link Command Injection Dir 823x Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 11, 2026 - 18:59 vuln.today

Public exploit code

CVE Published

Feb 08, 2026 - 02:15 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/set_ac_status. Performing a manipulation of the argument ac_ipaddr/ac_ipstatus/ap_randtime results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

Unauthenticated remote attackers can execute arbitrary OS commands on D-Link DIR-823X routers through command injection in the /goform/set_ac_status endpoint via manipulation of ac_ipaddr, ac_ipstatus, or ap_randtime parameters. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at immediate risk.

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects Dir-823X Firmware. A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/set_ac_status. Performing a manipulation of the argument ac_ipaddr/ac_ipstatus/ap_randtime results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.