CVE-2026-4193
Published: 16 March 2026
Summary
CVE-2026-4193 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Dlink Dir-823G Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations to prevent unauthorized remote access to vulnerable goahead web server functions like GetDDNSSettings and SetAccessCtlList.
Addresses CWE-266 incorrect privilege assignment by ensuring minimal privileges for processes handling the affected router configuration functions.
Prohibits use of end-of-life unsupported system components like the D-Link DIR-823G router, eliminating exposure to this unpatchable vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper access control in public-facing GoAhead web server on router directly enables T1190 exploitation for unauthenticated remote config access; facilitates T1562.004 via Set* firewall/access functions and T1602.002 via multiple Get* config/settings functions.
NVD Description
A security vulnerability has been detected in D-Link DIR-823G 1.0.2B05. The affected element is the function GetDDNSSettings/GetDeviceDomainName/GetDeviceSettings/GetDMZSettings/GetFirewallSettings/GetGuestNetworkSettings/GetLanWanConflictInfo/GetLocalMacAddress/GetNetworkSettings/GetQoSSettings/GetRouterInformationSettings/GetRouterLanSettings/GetWanSettings/SetAccessCtlList/SetAccessCtlSwitch/SetDeviceSettings/SetGuestWLanSettings/SetIPv4FirewallSettings/SetNetworkSettings/SetNetworkTomographySettings/SetNTPServerSettings/SetRouterLanSettings/SetStaticClientInfo/SetStaticRouteSettings/SetWLanRadioSecurity/SetWPSSettings/UpdateClientInfo of the component goahead. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed publicly…
more
and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2026-4193 is an improper access control vulnerability affecting the goahead web server component in D-Link DIR-823G routers running firmware version 1.0.2B05. The issue resides in multiple functions, including GetDDNSSettings, GetDeviceDomainName, GetDeviceSettings, GetDMZSettings, GetFirewallSettings, GetGuestNetworkSettings, GetLanWanConflictInfo, GetLocalMacAddress, GetNetworkSettings, GetQoSSettings, GetRouterInformationSettings, GetRouterLanSettings, GetWanSettings, SetAccessCtlList, SetAccessCtlSwitch, SetDeviceSettings, SetGuestWLanSettings, SetIPv4FirewallSettings, SetNetworkSettings, SetNetworkTomographySettings, SetNTPServerSettings, SetRouterLanSettings, SetStaticClientInfo, SetStaticRouteSettings, SetWLanRadioSecurity, SetWPSSettings, and UpdateClientInfo. It is associated with CWEs-266 (Incorrect Privilege Assignment) and CWE-284 (Improper Access Control).
The vulnerability enables remote exploitation over the network by unauthenticated attackers with low attack complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Attackers can achieve low-level impacts on confidentiality, integrity, and availability, such as unauthorized access to settings or limited modifications.
Advisories note that the vulnerability only affects products no longer supported by the maintainer, implying no official patches or updates are available. References on GitHub (wudipjq/my_vuln repositories) and VulDB detail the issue, including publicly disclosed exploits that may be used for demonstration or attacks.
The exploit has been publicly disclosed, increasing the risk for exposed, end-of-life D-Link DIR-823G devices.
Details
- CWE(s)