CVE-2025-11095: D-Link DIR-823X delete_offline_device command injection

Published Sep 28, 2025

Updated

A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/deleteofflinedevice. Performing manipulation of the argument delvalue results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Affected Software

3 affected components

D-Link DIR-823X

All of the following

Dlink Dir-823x Firmware=250416

Dlink Dir-823x

Event History

Sep 28, 2025

CVE Published

via MITRE·04:02 AM

Data Sourced

via MITRE·04:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11095?

CVE-2025-11095 is considered a high severity vulnerability due to its potential for remote command injection.

How do I fix CVE-2025-11095?

To fix CVE-2025-11095, it is recommended to update the D-Link DIR-823X router to the latest firmware version provided by the manufacturer.

What type of vulnerability is CVE-2025-11095?

CVE-2025-11095 is a command injection vulnerability that can be exploited through manipulation of specific arguments in the router's code.

Can CVE-2025-11095 be exploited remotely?

Yes, CVE-2025-11095 allows for remote exploitation, enabling attackers to execute commands on the affected D-Link DIR-823X devices.

What components are affected by CVE-2025-11095?

CVE-2025-11095 specifically affects the /goform/delete_offline_device function in the D-Link DIR-823X router.