CVE-2025-10401

A vulnerability was detected in D-Link DIR-823x up to 250416. The affected element is an unknown function of the file /goform/diag_ping. Performing manipulation of the argument target_addr results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDBCNA
6.3 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 30%
VendorProductVersion
dlinkdir-823x_firmware
𝑥
≤ 250416
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Cpppq43/D-Link/blob/main/D-Link%20DIR-823X%20AX3000.md
https://vuldb.com/?ctiid.323836
https://vuldb.com/?id.323836
https://vuldb.com/?submit.646761
https://www.dlink.com/