CVE-2026-2155: D-Link DIR-823X Configuration set_dmz sub_4208A0 os command injection
A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub4208A0 of the file /goform/setdmz of the component Configuration Handler. The manipulation of the argument dmzhost/dmzenable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2155?
CVE-2026-2155 is considered a critical severity vulnerability due to its potential for remote command execution.
How does CVE-2026-2155 affect D-Link DIR-823X devices?
CVE-2026-2155 allows attackers to execute arbitrary commands on the D-Link DIR-823X through improper handling of DMZ configuration parameters.
How do I fix CVE-2026-2155?
To fix CVE-2026-2155, update the D-Link DIR-823X firmware to the latest version that addresses this vulnerability.
Is CVE-2026-2155 remotely exploitable?
Yes, CVE-2026-2155 can be exploited remotely without authentication, making it particularly dangerous.
What should I do if my D-Link DIR-823X is vulnerable to CVE-2026-2155?
If your D-Link DIR-823X is vulnerable to CVE-2026-2155, immediately apply firmware updates and consider reconfiguring your network security settings.