CVE-2026-2082

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/set_mac_clone. Such manipulation of the argument mac leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
D-Link	DIR-823X	250416

References

https://github.com/master-abc/cve/issues/21Exploit, Issue Tracking
https://github.com/master-abc/cve/issues/21#issue-3847172823Exploit, Issue Tracking
https://vuldb.com/?ctiid.344649Permissions Required, VDB Entry
https://vuldb.com/?id.344649Third Party Advisory, VDB Entry
https://vuldb.com/?submit.745854Third Party Advisory, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208207.8Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CVE-2026-208216.2Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose info CVE-2026-208227.8Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2026-208235.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information lo CVE-2026-208245.5Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally.CVE-2026-208254.4Improper access control in Windows Hyper-V allows an authorized attacker to disclose information locally.CVE-2026-208267.0Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsys CVE-2026-208275.5Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker CVE-2026-208284.6Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical atta CVE-2026-208295.5Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally.CVE-2026-20839.8A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.p CVE-2026-208307.0Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc)