Introduction
Remote attackers can take control of D-Link DIR-823X routers up to firmware 250416 through a command injection flaw in the device's DHCP static lease configuration. The vulnerability has been publicly disclosed, proof-of-concept code is available, and security communities are actively discussing it. D-Link is a major networking equipment vendor that sells worldwide, and the DIR-823X series is widely used in home and small office networks. The flaw affects a large installed base, and exploitation can result in full device compromise.
Technical Information
CVE-2025-10123 is a command injection vulnerability in the sub_415028 function of the D-Link DIR-823X router firmware (up to version 250416). An attacker triggers it by sending a crafted HTTP POST request to the /goform/set_static_leases endpoint with a manipulated Hostname parameter. The router's web interface does not properly sanitize this parameter, so attackers can inject shell metacharacters and execute arbitrary system commands with root privileges.
The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-77 (Improper Neutralization of Special Elements used in a Command). Public research and related vulnerabilities in the DIR-823X firmware show that user input goes directly into system commands without adequate filtering or escaping. An attacker can terminate the intended command and append malicious instructions after it.
For example, an attacker could send this payload in the Hostname field:
legitimate_hostname; rm -rf /
The router would then execute both the intended command and the injected one. The vulnerability is remotely exploitable and does not require physical access to the device. The root cause is missing input validation and output encoding in the web interface code that handles DHCP static lease assignments.
Affected Systems and Versions
- Product: D-Link DIR-823X routers
- Affected firmware versions: Up to and including 250416
- Related firmware versions with similar issues: 240126, 240802 (based on public research)
- Vulnerable endpoint:
/goform/set_static_leases(sub_415028 function) - Vulnerable configuration: Routers with web interface exposed and DHCP static lease configuration enabled
Vendor Security History
D-Link has a history of similar command injection and input validation vulnerabilities across multiple router models and firmware versions. Previous issues include:
- Command injection in
/goform/set_ntp(ntp_zone_val parameter) - Command injection in
/goform/set_lan_settings(dhcpd_startip parameter) - Command injection in
/goform/diag_nslookup(target_addr parameter)
Patch response times have varied. Some vulnerabilities received only beta firmware fixes, and some in end-of-life products remain unpatched. Public advisories and research have questioned the overall security maturity of D-Link's router firmware development.
