Vulnerability · Published Sep 18, 2025 · Assigned by VulDB

CVE-2025-10634D-Link DIR-823X Environment Variable goahead sub_412E7C command injection

Medium 6.3

In plain English

A medium-severity command injection in DIR-823X from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 6.3% (higher than 94% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)6.3%top 6.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminal_addr/server_ip/server_port causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

Affected products (as reported)

Vendor	Product	Versions
D-Link	DIR-823X	240126240802250416

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-324662 | D-Link DIR-823X Environment Variable goahead sub_412E7C command injection vdb-entry, technical-description
VDB-324662 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #650792 | D-Link DIR-823X DIR-823x 250416, 240802, 240126 Command Injection third-party-advisory
https://github.com/Cpppq43/D-Link/blob/main/DIink-DIR-823x.md related
https://pan.baidu.com/s/1dWnXEa58P0KHw53L9U_PoQ exploit
https://www.dlink.com/ product