CVE-2025-11092 MEDIUM

CVE-2025-11092: D-Link DIR-823X set_switch_settings sub_412E7C command injection

Vendor D-Link
Product DIR-823X
Weakness CWE-77
Published September 28, 2025
Last update September 29, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Key dates

02Disclosure timeline

September 28, 2025 CVE published
September 29, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-12916 Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection CVE-2026-5178 Totolink A3300R cstecgi.cgi setIptvCfg command injection CVE-2024-3908 Tenda AC500 WriteFacMac formWriteFacMac command injection CVE-2026-24685 OpenProject has Argument Injection on Repository module that allows Arbitrary File Write CVE-2024-32026 Kohya_ss is vulnerable to a command injection in `git_caption_gui.py` (`GHSL-2024-020`)