CVE-2023-51123 is a critical severity (CVSS 9.8) OS command injection in D-Link DIR-815 firmware 1.01SSb08, in the soapcgi_main function of the cgibin binary. The record names no fix, so check D-Link's support pages and keep the router's web interface off the internet.
What's affected
The NVD description says an issue in D-Link dir815 v1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the service parameter in the soapcgi_main function of the cgibin binary component. The references are a researcher repository and its README.
The record names no fixed firmware, and I did not load the references. Confirm the status of this model and firmware with D-Link, including whether the model still receives updates.
CVSS for this entry is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Read the firmware version on the router's status page. If it reads 1.01SSb08, it matches the record.
Check whether the router's web management is reachable from the internet, and whether UPnP or port forwarding exposes any services. The NVD vector needs no privileges and no interaction, so reachability is the key question.
What to do now
- Identify DIR-815 routers and note the firmware.
- Ask D-Link whether a firmware update exists for this CVE, or whether the model is no longer supported.
- Disable remote administration and place the router behind a firewall you control.
- If no update exists, plan to replace the device, and treat the network behind it as less trusted until you do.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-78 is OS command injection. Input reaches a shell command without being neutralized, so the attacker can add commands of their own. The fix is to avoid building shell commands from input, or to validate input against a strict allowlist.
CWE-78 is OS command injection. The router builds a shell command from a request parameter without neutralizing it, so a remote request can add commands. With no authentication needed, the NVD scores it 9.8.
Small office routers sit at the network edge, so a takeover gives an attacker a position to watch and redirect traffic. The record does not mark it as exploited in the wild, and I read no source that says so.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need to log in?
The vector says no privileges are required.
What if D-Link has no fix?
Then replacement is the safer route. Confirm the support status with D-Link.
Sources
Last reviewed: 19 October 2026.
