CVE-2026-2157
Published: 08 February 2026
Summary
CVE-2026-2157 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Dir-823X Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2157 is an OS command injection vulnerability (CWE-77, CWE-78) in the D-Link DIR-823X router running firmware version 250416. The flaw affects the function sub_4175CC in the file /goform/set_static_route_table, where manipulation of arguments including interface, destip, netmask, gateway, and metric enables arbitrary command execution.
The vulnerability is remotely exploitable over the network with low complexity and no user interaction required, but demands high privileges (PR:H) from the attacker. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), allowing successful exploitation to result in high impacts to confidentiality, integrity, and availability through injected OS commands.
Advisories and additional details are documented at https://github.com/master-abc/cve/issues/28, https://vuldb.com/?ctiid.344859, https://vuldb.com/?id.344859, https://vuldb.com/?submit.748376, and https://www.dlink.com/. The exploit has been publicly disclosed and may be used.
The vulnerability was published on 2026-02-08, with the proof-of-concept exploit already available in public repositories.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5792
Vulnerability details
A security vulnerability has been detected in D-Link DIR-823X 250416. This affects the function sub_4175CC of the file /goform/set_static_route_table. Such manipulation of the argument interface/destip/netmask/gateway/metric leads to os command injection. The attack may be performed from remote. The exploit has…
more
been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public web form (/goform) of network device directly enables remote exploitation of public-facing application and Unix shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks OS command injection by validating/sanitizing the interface, destip, netmask, gateway, and metric arguments before they reach sub_4175CC.
Limits the high privileges (PR:H) required to reach /goform/set_static_route_table, reducing the chance an attacker can invoke the vulnerable function.
Enforces access restrictions on the specific route-table endpoint so that only authorized subjects can submit the tainted parameters.