CVE-2025-11099

HighCVSS 8.8/10Last modified Oct 9, 2026

Description

A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
D-Link	DIR-823X	250416

References

https://github.com/n1ptune/dink/blob/main/uci_del_in_delete_prohibiting.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.326180Permissions Required, VDB Entry
https://vuldb.com/?id.326180Third Party Advisory, VDB Entry
https://vuldb.com/?submit.661916Third Party Advisory, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Sep 28, 2025
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-11104.3An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited p CVE-2025-111008.8A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such ma CVE-2025-111019.8A security flaw has been discovered in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admi CVE-2025-111029.8A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/edit_c CVE-2025-111037.2A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown funct CVE-2025-111048.8A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /CVE-2025-111059.8A flaw has been found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /schedulingsystem/addsubject.p CVE-2025-111069.8A vulnerability has been found in code-projects Simple Scheduling System 1.0. This vulnerability affects unknown code of the file /schedulin CVE-2025-111079.8A vulnerability was found in code-projects Simple Scheduling System 1.0. This issue affects some unknown processing of the file /schedulings CVE-2025-111089.8A vulnerability was determined in code-projects Simple Scheduling System 1.0. Impacted is an unknown function of the file /schedulingsystem/CVE-2025-111099.8A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file CVE-2025-111109.8A security flaw has been discovered in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the f