CVE-2026-2129: D-Link DIR-823X set_ac_status os command injection
A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/setacstatus. Performing a manipulation of the argument acipaddr/acipstatus/aprandtime results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2129?
CVE-2026-2129 has been classified as a high severity vulnerability due to its potential to allow remote code execution via OS command injection.
How do I fix CVE-2026-2129?
To fix CVE-2026-2129, update the D-Link DIR-823X firmware to the latest version provided by D-Link that addresses this vulnerability.
What devices are affected by CVE-2026-2129?
CVE-2026-2129 affects the D-Link DIR-823X router specifically in the handling of the /goform/set_ac_status file.
What are the potential risks of CVE-2026-2129?
The risks of CVE-2026-2129 include potential unauthorized access and execution of arbitrary commands on the affected device.
Is there a known exploit for CVE-2026-2129?
Yes, there are known methods to exploit CVE-2026-2129, which involve manipulating the parameters in the set_ac_status function.