CVE-2025-10123

This vulnerability is like leaving a hidden “back door” in a router’s management feature. If someone can reach that feature over the internet, they can trick the router into running unintended commands.

In a small business, that can mean an attacker gaining control of your network settings and causing disruption or interception.

This matters if you use D-Link DIR-823X and its firmware is at or below 250416. It specifically targets a router web feature used to set “static leases.”

It’s a risk when the vulnerable router endpoint is reachable remotely—especially if management or the relevant web interface is exposed to the internet.

This is RED because there’s publicly available exploitation material (a public proof-of-concept) and sustained press/incident attention pointing to real-world risk. Attackers don’t need special tricks beyond reaching the router and using the vulnerable input to trigger command injection.

Prioritize blocking internet access to router management immediately, then apply the vendor’s fixed firmware update as soon as you can.

1. Inventory and version check

   • Confirm the affected model: D-Link DIR-823X.
   • In the router’s admin UI, note the firmware version.
   • Treat DIR-823X firmware versions up to 250416 as vulnerable.

2. Exposure check (reachability gate)

   • Determine whether remote administration is enabled.
   • Check for port forwarding, UPnP auto-opening, or any firewall rules that allow WAN/internet access to the router’s admin/web interface.
   • If any WAN-to-router management path exists, assume exposure.

3. Immediate mitigation if exposed (temporary control)

   • Block inbound access from the internet to router management interfaces using your firewall.
   • Allow management only from your local network (internal IP ranges).
   • Remove/disable port-forwarding rules that expose web-management endpoints.
   • Disable remote administration features.

4. Long-term fix

   • Update DIR-823X to the vendor’s fixed firmware when available.
   • After upgrading, re-check firmware version and re-verify that remote management is not reachable from the internet.

5. What to monitor after changes

   • Monitor for unusual router configuration changes.
   • Review any router/admin logs available for repeated requests to web endpoints related to “static leases” or similar repeated access attempts.
   • If you suspect compromise, consider restoring to a known-good configuration after the firmware update and rotate any admin credentials.

CVE-2025-10123 (CWE-74 / CWE-77) is a command injection issue in D-Link DIR-823X (DIR-823X firmware). The vulnerable code path is function sub_415028 in /goform/set_static_leases, where manipulation of the Hostname argument can lead to injected command execution.

Exploitation status: public proof-of-concept exists (3 known). KEV entry is not listed in CISA KEV, but sustained press/incident attention and public PoC justify urgent remediation.

Attack vector: remote via the router’s web endpoint (HTTP form handler), requiring that the affected endpoint be reachable from where the attacker is operating (internet reachability is the practical gating factor).

EPSS is available as a prediction, but it’s overridden in priority by the presence of public exploitation material and incident/press signals in the findings; do not rely on the EPSS value to assess risk for action.