CVE-2025-2359 is a high severity (CVSS 7.3) improper authorization flaw in the SetDDNSSettings function of the D-Link DIR-823G router, firmware 1.0.2B05_20181207. The record says the product is no longer supported by the maintainer, so no patch is expected. Replace the router or restrict its management interface.
What's affected
The NVD record, written by VulDB, names the D-Link DIR-823G with firmware 1.0.2B05_20181207. The affected function is SetDDNSSettings in the HNAP1 interface, part of the dynamic DNS service component, and the SOAPAction argument leads to improper authorization. The attack can be launched remotely and the exploit has been disclosed publicly.
The record states that the vulnerability only affects products that are no longer supported by the maintainer. That matters more than the score: there is no vendor fix to wait for, and the D-Link site listed in the references is the place to look for any end of life notice. The VulDB page could not be fetched for this review.
How to check if you're exposed
Log in to the router's admin page and read the firmware version on the status page. If it shows 1.0.2B05_20181207, you are on the version named in the record.
Then check exposure. From outside your network, test whether the router's web management port answers. On the router, look for remote management settings and turn them off if enabled. Review the dynamic DNS configuration for entries you did not create.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Identify every DIR-823G in use, including at branch offices and homes of remote staff.
- Turn off remote administration and make sure the admin interface is reachable only from the internal network.
- Check the dynamic DNS settings for unexpected values and reset the admin password.
- Plan to replace the router with a supported model, because the record says the product is out of support.
- Keep the router off networks that hold sensitive systems until it is replaced.
Why it matters
CWE-285 is improper authorization and CWE-266 is incorrect privilege assignment. The router exposes an administrative function through its HNAP1 interface without properly checking that the caller is allowed to use it.
A router sits on the path of all traffic for the network behind it, so weak control over its settings is worth taking seriously. The deeper problem is lifecycle. Devices past end of support keep running for years, and each new flaw stays open permanently. The KEV flag is false and no exploitation is claimed.
Quick check
Will D-Link release a patch?
The record says the issue only affects products no longer supported by the maintainer, so a fix should not be expected.
What is the safest action?
Replace the router with a supported model. Until then, turn off remote management and limit access to the admin interface.
Sources
Last reviewed: 19 October 2026.
