D-Link DIR-823 Remote Code Execution Vulnerability via Command Injection in Password Settings

A remote code execution vulnerability has been identified in the D-Link DIR-823 router, specifically in the firmware version 20250416. The issue arises in the set_password interface, where the http_passwd parameter is not properly sanitized. This lack of filtering allows for the injection of reverse connection commands, enabling unauthorized execution of arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows remote, unauthenticated attackers to execute arbitrary commands with root privileges on the affected device.

Reproduction

To reproduce this vulnerability, log into the router's web interface and navigate to the password settings. The old password must be set to 'admin', which is hardcoded as the default. Once the old password is accepted, the http_passwd parameter can be manipulated to inject commands that will be executed on the router's operating system.