CVE-2026-1125
published 2026-01-18CVE-2026-1125: A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing…
PriorityP185critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
14.38%
96.2th percentile
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of the argument wd_enable can lead to command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d-link | dir-823x | — | — |
| dlink | dir-823x_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link set_wifidog_settings wd_enable Parameter Command Injection Attempt (CVE-2026-1125)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:28; content:"/goform/set_wifidog_settings"; fast_pattern; http.request_body; content:"wd_enable|3d|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/DavCloudz/cve/blob/main/D-link/DIR_823X/DIR-823X%20V250416%20Command%20Execution%20Vulnerability.md; reference:cve,2026-1125; classtype:attempted-admin; sid:2067089; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_01_26, cve CVE_2026_1125, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_01_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes
wd_enable=
- →Exploit targets HTTP POST requests to the exact URI /goform/set_wifidog_settings (URI length is exactly 28 bytes); match on this path combined with POST method.
- →Command injection payload is embedded in the request body in the wd_enable parameter; look for shell metacharacters (;, newline \x0a, backtick \x60, pipe \x7c, dollar \x24) immediately following the wd_enable= value, including URL-encoded variants (%3B, %0A, %60, %7C, %24).
- →The vulnerable function is sub_412E7C in the firmware binary; the argument wd_enable is the injection point. Focus analysis on this function when performing firmware reverse engineering.
- →Traffic is expected in plaintext (no TLS); deploy detection at the network perimeter and internally.
- →Public exploit PoC is available; treat any matching traffic as high-severity attempted-admin exploitation (MITRE T1190 – Exploit Public-Facing Application).
- ·The Snort/Suricata rule uses a strict URI byte-size match (bsize:28); ensure your IDS/IPS engine supports the bsize keyword, otherwise the URI content match alone may produce false positives.
- ·The PCRE anchors on the wd_enable parameter value and stops at the & delimiter (\x26); multi-parameter POST bodies where wd_enable is not the first parameter may require rule tuning.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
ghsa·2026-05-29
CVE-2026-47184 [MEDIUM] CWE-400 zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
### Impact
`DNSCache._async_add` inserted every response record into `cache`, `_expirations`, `_expire_heap`, and `service_cache` with no cap on entry count. The only pre-existing protection was a PTR TTL floor (`_DNS_PTR_MIN_TTL = 1125` s, RFC 6762 §10), which actually *prolonged* attacker-injected records, and a periodic `async_expire` on `_CACHE_CLEANUP_INTERVAL = 10` s that could not keep up with a flood.
Any unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can multicast valid mDNS responses with unique names (RFC 6762 §11 allows up to 253 bytes each) and watch them accumulate. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardwar
GHSA
GHSA-8whh-2x7g-j9cx: A weakness has been identified in D-Link DIR-823X 250416
ghsa_unreviewed·2026-01-18
CVE-2026-1125 [MEDIUM] CWE-74 GHSA-8whh-2x7g-j9cx: A weakness has been identified in D-Link DIR-823X 250416
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of the argument wd_enable can lead to command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
VulnCheck
D-Link dir-823x_firmware Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
vulncheck·2026·CVSS 9.8
CVE-2026-1125 [CRITICAL] D-Link dir-823x_firmware Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
D-Link dir-823x_firmware Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of the argument wd_enable can lead to command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Affected: D-Link dir-823x_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-02&host_type=src&vul
Suricata
ET WEB_SPECIFIC_APPS D-Link set_wifidog_settings wd_enable Parameter Command Injection Attempt (CVE-2026-1125)
suricata·2026-01-26·CVSS 6.9
CVE-2026-1125 [MEDIUM] ET WEB_SPECIFIC_APPS D-Link set_wifidog_settings wd_enable Parameter Command Injection Attempt (CVE-2026-1125)
ET WEB_SPECIFIC_APPS D-Link set_wifidog_settings wd_enable Parameter Command Injection Attempt (CVE-2026-1125)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link set_wifidog_settings wd_enable Parameter Command Injection Attempt (CVE-2026-1125)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:28; content:"/goform/set_wifidog_settings"; fast_pattern; http.request_body; content:"wd_enable|3d|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/DavCloudz/cve/blob/main/D-link/DIR_823X/DIR-823X%20V250416%20Command%20Execution%20Vulnerability.md; reference:cve,2026-1125; classtype:attempted-admin; sid:2067089; rev:1; metadata:affected_product D_Link, attack_target Networ
No public exploits indexed.
No writeups or analysis indexed.
2026-01-18
Published
Exploited in the wild