CVE-2023-51984 is a critical command injection in the SetStaticRouteSettings function of D-Link DIR-822+ firmware 1.0.2, scored 9.8 by NVD. A remote attacker can run commands on the router. No fix is confirmed, so check D-Link support and turn off remote administration.
What's affected
CVE-2023-51984 affects D-Link DIR-822+ firmware version 1.0.2. NVD published it on 2024-01-11 with a score of 9.8 (critical) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The reporter's write-up says the SetStaticRouteSettings function takes entries from the static route list, splits them on commas and passes the pieces to a helper that builds a command and runs it through popen with no filtering. I found no D-Link advisory in the record's references and no fixed firmware, so check D-Link's support and security pages for this model.
The write-up was published on GitHub and includes an exploit request. I have not reproduced it here. The record's KEV flag is false and I did not find a source that reports attacks in the wild.
Weakness class: CWE-78.
How to check if you're exposed
Check the firmware version in the router's admin interface, usually under the system or firmware menu, and compare it with 1.0.2. Menu names vary by revision.
Next check how the admin interface can be reached. If remote management is on, or the router has a public address with a forwarded admin port, the web service answers to the internet.
Look at the router's static route list. Entries you did not add, or entries that contain odd characters, are worth investigating. Also check DNS and DHCP settings for values you did not choose.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages you ship. It does not inspect appliance firmware or a vendor's closed product, so for this CVE the useful work is asset inventory and vendor follow-up.
What to do now
- List all D-Link DIR-822+ routers, including those at remote offices and homes.
- Visit D-Link's support site for firmware newer than 1.0.2 and read the notes. If none lists this issue, ask D-Link directly and ask whether the model is still supported.
- Disable remote administration and restrict the admin interface to the LAN.
- Change the administrator password, and review static routes, DNS and DHCP settings after any suspected exposure.
- If the model gets no security updates, plan its replacement and treat it as untrusted until then.
Why it matters
The weakness is CWE-78, OS command injection. The reporter's analysis shows the pattern in plain form: a string from the request is split and handed to a function that runs a shell command, and nothing in between checks that the pieces are what they should be. Anyone who can supply the string gets to add commands.
Routers sit on the boundary of a network, so code execution on one gives control of traffic and a foothold for reaching internal devices. That is why the same weakness class keeps appearing in router advisories. Safe code passes arguments directly to a program instead of building a command string for a shell.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which firmware fixes CVE-2023-51984?
I could not confirm one. The record lists no vendor advisory. Check D-Link's support page for the DIR-822+.
Does the attacker need a login?
The NVD vector says no privileges required, so a login is not part of the scored attack. Check your own firmware's behaviour and keep the admin interface private.
Sources
Reporter write-up on GitHub (fetched, third party; exploit details are not reproduced here)
NVD record for CVE-2023-51984 (the record this guide is built from)
Last reviewed: 19 October 2026.
