CVE-2026-2155

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz of the component Configuration Handler. The manipulation of the argument dmz_host/dmz_enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
D-Link	DIR-823X	250416

References

https://github.com/master-abc/cve/issues/32Exploit, Issue Tracking
https://vuldb.com/?ctiid.344857Permissions Required, VDB Entry
https://vuldb.com/?id.344857Third Party Advisory, VDB Entry
https://vuldb.com/?submit.748236Third Party Advisory, VDB Entry
https://vuldb.com/?submit.750038Third Party Advisory, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Feb 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-215507.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges CVE-2026-215517.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges CVE-2026-215527.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges CVE-2026-215537.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges CVE-2026-215547.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges CVE-2026-215557.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges CVE-2026-21564.8A weakness has been identified in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the fil CVE-2026-215697.9This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. Th CVE-2026-21577.2A security vulnerability has been detected in D-Link DIR-823X 250416. This affects the function sub_4175CC of the file /goform/set_static_ro CVE-2026-215708.8This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0 CVE-2026-215718.8This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0,CVE-2026-215758.0This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windo