CVE-2026-2143

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddns of the component DDNS Service. The manipulation of the argument ddnsType/ddnsDomainName/ddnsUserName/ddnsPwd leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
D-Link	DIR-823X	250416

References

https://github.com/master-abc/cve/issues/25Exploit, Issue Tracking
https://vuldb.com/?ctiid.344778Permissions Required, VDB Entry
https://vuldb.com/?id.344778Third Party Advisory, VDB Entry
https://vuldb.com/?submit.747492Third Party Advisory, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Feb 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-214309.3Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forge CVE-2026-214315.4Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media libra CVE-2026-214325.4Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account tak CVE-2026-214337.7Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) request CVE-2026-214347.5webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption i CVE-2026-214357.5webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtranspo CVE-2026-214365.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `CVE-2026-214375.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tr CVE-2026-214385.3webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repea CVE-2026-214395.3badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker ma CVE-2026-21448.1The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This CVE-2026-214409.2AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker