CVE-2025-55848

HIGH

D-Link DIR-823X Firmware 20250416 - http_casswd Command Injection

Title source: manual

Description

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not filtered by '&'to allow injection of reverse connection commands.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/meigui637/iot_zone/blob/main/%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md

View Exploit ZIP pw:eip

Product

https://www.dlink.com/en/security-bulletin/

Scores

CVSS v3 8.8

EPSS 0.0010

EPSS Percentile 27.5%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-77

Status published

Products (2)

dlink/dir-823x_firmware 2025-04-16

dlink/dir-823x_firmware 250416

Published Sep 26, 2025

Tracked Since Feb 18, 2026