CVE-2025-10123: High Command Injection in D-Link DIR-823X Router

CVE-2025-10123 is a high severity command injection (CVSS 7.3) in D-Link DIR-823X routers up to firmware 250416, through the Hostname argument of a static leases form. The record lists no fixed version, so check D-Link's advisory page and keep the admin interface off the internet.

What's affected

The record names the D-Link DIR-823X, and its firmware up to 250416. The function sub_415028 in the file /goform/set_static_leases handles the Hostname argument, and manipulating it can lead to command injection. The weakness classes are CWE-77 (command injection) and CWE-74 (injection).

The record scores it 7.3 HIGH. The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reads as network reachable, low attack complexity, no privileges and no user interaction. Impact on confidentiality is limited, on integrity limited, and on availability limited. It says the exploit has been publicly disclosed. It does not state whether the vendor has released a fix, and I could not retrieve the vendor or the researcher's page, so the vendor site is where to look for a firmware update. Do not assume a fix exists until you have seen it.

How to check if you're exposed

1. Confirm the model on the label of the router and in the admin page.
2. Read the firmware version on the admin status page. The record's range is up to 250416, so a build at or below that value is in scope.
3. Check whether remote management is enabled. If it is, the admin interface may be reachable from the internet.
4. Look at the DHCP static lease list in the admin page for entries you did not create. Hostname fields that contain odd characters are worth a closer look.

What to do now

1. Check D-Link's support page for a firmware newer than 250416 and install it if one is offered. Back up the router configuration first.
2. Turn off remote administration on the WAN side.
3. Limit the admin interface to a single trusted device on the LAN and use a strong, unique admin password.
4. If the model is unsupported or no update appears, plan to replace it.
5. Review the router configuration, DNS settings and static leases for changes you did not make.
6. Track edge devices in an inventory with firmware versions. The free in-browser dependency scan and the Gold directory show which known issues sit in the components you ship.

Why it matters

Command injection happens when a device builds a system command from user input without cleaning it, so part of the input is run as a command. Small routers do this more often than most software because many of their web handlers call shell utilities directly. The router's web service usually runs as root, so a successful injection can mean full control of the device.

This type of flaw is easy to describe and easy to repeat across different form fields, so a single advisory often points to more than one weak handler. The record is not marked as exploited in the wild by CISA, and I found no statement of active exploitation. The advice is the usual one for home and branch routers: keep admin access off the internet, update firmware when the vendor offers it, and replace devices that stop getting updates.

Quick check

Sources

• NVD record for CVE-2025-10123 and its references to the researcher write-up (not independently verified)
• D-Link

Last reviewed: 19 October 2026.