CVE-2026-2210

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipulation leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
D-Link	DIR-823X	250416

References

https://github.com/master-abc/cve/issues/34Issue Tracking
https://github.com/user-attachments/files/25010265/Remote.Command.Injection.in.D-Link.DIR-823X.via._goform_set_filtering.zipExploit
https://vuldb.com/?ctiid.344925Permissions Required, VDB Entry
https://vuldb.com/?id.344925Third Party Advisory, VDB Entry
https://vuldb.com/?submit.752165Third Party Advisory, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Feb 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-221008.6The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can b CVE-2026-221015.1The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial CVE-2026-221029.3A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename par CVE-2026-221039.3The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.CVE-2026-221047.1Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account CVE-2026-221058.7Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. A CVE-2026-221098.4The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical ac CVE-2026-22119.8A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminD CVE-2026-221108.7The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the config CVE-2026-221145.3HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.CVE-2026-22129.8A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the fil CVE-2026-22137.2A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file