CVE-2025-11098: D-Link DIR-823X set_wifi_blacklists command injection

Published Sep 28, 2025

Updated

A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/setwifiblacklists. The manipulation of the argument macList results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

Affected Software

3 affected components

D-Link DIR-823X

All of the following

Dlink Dir-823x Firmware=250416

Dlink Dir-823x

Event History

Sep 28, 2025

CVE Published

via MITRE·05:32 AM

Data Sourced

via MITRE·05:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11098?

CVE-2025-11098 is considered a high severity vulnerability due to its potential for remote command injection.

How do I fix CVE-2025-11098?

To fix CVE-2025-11098, update the D-Link DIR-823X firmware to the latest version provided by the vendor.

What type of attack is associated with CVE-2025-11098?

CVE-2025-11098 is associated with a remote command injection attack targeting the Wi-Fi blacklist configuration.

Who is affected by CVE-2025-11098?

CVE-2025-11098 affects users of the D-Link DIR-823X router with the firmware version 250416.

Can CVE-2025-11098 be exploited without local access?

Yes, CVE-2025-11098 can be exploited remotely, allowing unauthorized users to execute commands.