CVE-2025-29040

The vulnerability lies in the handling of the 'target_addr' parameter in the function located at address 0x41737c, likely related to the diagnostic ping function (diag_ping). Data passed by the attacker in the 'target_addr' key is not properly validated or sanitized before being passed to a system call. This enables injection of arbitrary system commands (command injection), which are executed with the privileges of the process handling the request.

A remote attacker, without any authentication, can execute arbitrary code on the device, which in practice means complete takeover of the router, including the ability to modify configuration, intercept network traffic, or use the device as a launch point for further attacks on the local network.

Apply patches available from the manufacturer according to the references — check the D-Link security bulletin at https://www.dlink.com/en/security-bulletin/. Until the patch is released and deployed, it is recommended to restrict access to the device's administrative interface to trusted hosts only and disable access from the WAN side.

D-Link DIR-823X with firmware version 240802