CVE-2025-2717: D-Link DIR-823X HTTP POST Request diag_nslookup sub_41710C os command injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-25 · updated 2026-06-17
Weakness: CWE-77

Description

A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /goform/diag_nslookup of the component HTTP POST Request Handler. The manipulation of the argument target_addr leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

D-Link DIR-823X: 240126, 240802

References

https://github.com/mono7s/Dir-823x/blob/main/diag_nslookup/diag_nslookup.md
https://vuldb.com/?ctiid.300737
https://vuldb.com/?id.300737
https://vuldb.com/?submit.517958
https://www.dlink.com/
https://github.com/mono7s/Dir-823x/blob/main/diag_nslookup/diag_nslookup.md

Get alerted when CVE-2025-2717 or the next vulnerability affects your stack