An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not filtered by '&'to allow injection of reverse connection commands.
CVE-2025-55848
CVSS base score
8.8 (v3.1)
Severity
HIGH
Attack vector
Adjacent_network
Weakness
CWE-77
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
dlink dir-823x firmware
References
- github.com Exploit, Third Party Advisory
- www.dlink.com Product