GCVE - cpe:2.3:o:dlink:dir-823x_firmware:240126:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:dlink:dir-823x_firmware:240126:*:*:*:*:*:*:*

part: o version: 240126 update: *

Vendor	Dlink (`b610c9ff-f722-5d9d-a6df-9bee7f4d4b44`)
Product	Dir 823X Firmware (`da6edc02-3bfb-51b7-858e-149a4191ad23`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-2717`	vulnerable	2026-06-08 07:16:58.129681	D-Link DIR-823X HTTP POST Request diag_nslookup sub_41710C os command injection MEDIUM (4.7) A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /goform/diag_nslookup of the component HTTP POST Request Handler. The manipulation of the argument target_addr leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Published: 2025-03-24T23:31:05.104Z Updated: 2025-03-25T13:29:34.768Z Open on db.gcve.eu Reference links https://vuldb.com/?id.300737 https://vuldb.com/?ctiid.300737 https://vuldb.com/?submit.517958 https://github.com/mono7s/Dir-823x/blob/main/diag_nslookup/diag_nslookup.md https://www.dlink.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-29635`	vulnerable	2026-06-08 07:14:56.525398	Details available A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution. Published: 2025-03-25T00:00:00.000Z Updated: 2026-04-25T03:55:37.481Z Open on db.gcve.eu Reference links https://github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-1103`	vulnerable	2026-06-08 07:06:36.919817	D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereference MEDIUM (6.5) A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blacklists of the file /goform/set_wifi_blacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Published: 2025-02-07T15:00:10.453Z Updated: 2025-02-07T15:45:21.247Z Open on db.gcve.eu Reference links https://vuldb.com/?id.294933 https://vuldb.com/?ctiid.294933 https://vuldb.com/?submit.489603 https://tasty-foxtrot-3a8.notion.site/D-link-DIR-823X-set_wifi_blacklists-Vulnerability-1870448e619580e5bf09cf628692f7a9?pvs=73 https://www.dlink.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10814`	vulnerable	2026-06-08 07:02:27.552970	D-Link DIR-823X goahead command injection MEDIUM (6.3) A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Published: 2025-09-22T20:32:09.997Z Updated: 2025-09-23T20:17:43.980Z Open on db.gcve.eu Reference links https://vuldb.com/?id.325172 https://vuldb.com/?ctiid.325172 https://vuldb.com/?submit.654452 https://github.com/W1ngyu/cve/blob/main/DIink-DIR-823xgoformset_server_settings_command_execution_vulnerability.md https://www.dlink.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10634`	vulnerable	2026-06-08 07:02:27.243835	D-Link DIR-823X Environment Variable goahead sub_412E7C command injection MEDIUM (6.3) A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminal_addr/server_ip/server_port causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Published: 2025-09-18T01:02:15.143Z Updated: 2025-09-18T13:18:03.415Z Open on db.gcve.eu Reference links https://vuldb.com/?id.324662 https://vuldb.com/?ctiid.324662 https://vuldb.com/?submit.650792 https://github.com/Cpppq43/D-Link/blob/main/DIink-DIR-823x.md https://pan.baidu.com/s/1dWnXEa58P0KHw53L9U_PoQ	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-0492`	vulnerable	2026-06-08 07:02:24.708014	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-39962`	vulnerable	2026-06-08 06:41:52.133473	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-39202`	vulnerable	2026-06-08 06:41:48.771801	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.