CVE-2025-29041

An attacker can provide a crafted value for the 'target_addr' key (associated with the nslookup diagnostic function), which is then processed by the function at address 0x41710c without proper sanitization. Lack of input validation (CWE-78) leads to injection and execution of arbitrary system commands in the context of the request-handling process. The attack is possible remotely over the network without authentication.

An attacker can gain full control over the device, including reading or modifying its configuration, executing arbitrary system commands, and potentially using the router as an entry point to the local network.

Apply patches available from the manufacturer according to the references (https://www.dlink.com/en/security-bulletin/). Until an update is released, it is recommended to restrict access to the device's administrative interface exclusively to trusted IP addresses and to disable remote management from the WAN network side.

D-Link DIR-823X with firmware version 240802