What is the CVSS score of CVE-2026-2155?

CVE-2026-2155 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dir 823x Firmware are affected by CVE-2026-2155?

A high-severity vulnerability in D-Link DIR-823X routers allows unauthenticated attackers to manipulate DMZ configurations, potentially exposing internal network resources to external threats.

Is there a public PoC exploit available for CVE-2026-2155?

Yes, a public proof-of-concept exploit is available for CVE-2026-2155. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-2155?

Within 24 hours: Inventory all D-Link DIR-823X 250416 devices in your network and isolate affected units from production environments if possible. Within 7 days: Implement network segmentation to restrict access to administrative interfaces and disable DMZ functionality if not operationally required. Within 30 days: Monitor D-Link security advisories for patch availability and develop a firmware upgrade plan; consider replacing affected devices with patched models from alternative vendors if patches remain unavailable.

Dir 823x Firmware CVE-2026-2155

HIGH

Command Injection (CWE-77)

2026-02-08 cna@vuldb.com

D-Link Command Injection Dir 823x Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 11, 2026 - 18:44 vuln.today

Public exploit code

CVE Published

Feb 08, 2026 - 14:16 nvd

HIGH 7.2

DescriptionCVE.org

A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz of the component Configuration Handler. The manipulation of the argument dmz_host/dmz_enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Remote code execution in D-Link DIR-823X routers through OS command injection in the DMZ configuration handler allows unauthenticated attackers to execute arbitrary commands on affected devices. The vulnerability exists in the /goform/set_dmz endpoint where the dmz_host and dmz_enable parameters are insufficiently sanitized, and public exploit code is currently available. Organizations using DIR-823X firmware should prioritize patching as no official fix is currently available.

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects Dir-823X Firmware. A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz of the component Configuration Handler. The manipulation of the argument dmz_host/dmz_enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.