CVE-2026-2175

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. This manipulation of the argument upnp_enable causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Feb 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-217517.4HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise CVE-2026-217527.5HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the syCVE-2026-217534.2HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious tCVE-2026-217545.4HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movementCVE-2026-217555.3HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attackCVE-2026-217567.2HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, maCVE-2026-217583.7HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the hCVE-2026-217594.3HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.  Although no sensitiveCVE-2026-21768.8A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unknown processing of theCVE-2026-217604.6HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks CVE-2026-217615.4HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cCVE-2026-217625.3HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-bas
CVE-2026-2175: High severity, CVSS 7.2 | Vulnix