CVE-2026-1125 is a high-severity command injection (CVSS 7.3) in the D-Link DIR-823X router, firmware 250416. The wd_enable argument of the /goform/set_wifidog_settings handler can be manipulated remotely to run commands. The record lists no fixed firmware, so check D-Link for an update and keep the admin interface off the internet.
What's affected
- Product: D-Link DIR-823X, firmware version 250416.
- Vulnerable function:
sub_412E7C, reached through/goform/set_wifidog_settings. - Vulnerable argument:
wd_enable. - Fixed version: none listed in the record. The only vendor reference is the general D-Link website, so check the DIR-823X support page for newer firmware.
- Weakness classes: CWE-74 (injection) and CWE-77 (command injection).
- Exploitation: the record says the exploit has been made public. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is being exploited in the wild.
How to check if you're exposed
Routers do not show up in dependency scans, so this one is an inventory and exposure check.
- Find every DIR-823X on your networks, including branch offices and home offices that connect back to you.
- Open the router admin page and read the firmware version. Compare it with 250416, the version named in the record.
- Check whether the admin interface answers from the internet side. Scan your public address ranges from outside, or review the remote management setting on the device.
- Look at the router configuration for unexpected settings in the Wi-Fi captive portal area, since the vulnerable handler is named for the WiFiDog settings. Treat anything you did not set as a sign to reset and review.
What to do now
- Turn off remote administration on every DIR-823X, and limit the admin page to a management VLAN or a single trusted host.
- Check the D-Link support page for newer DIR-823X firmware. Read its release notes for this fix before you rely on it, because the record does not name a patched build.
- Change the admin password, and do it after the firmware update if you update, so a possibly exposed credential does not carry over.
- If the router sits at a site you cannot control, plan to replace it with a supported device when no fixed firmware appears.
Why it matters
Command injection means a value sent to the device ends up inside a command that the operating system runs. In routers this often sits in a settings handler that passes a form field to a shell helper. The record names wd_enable as the argument and gives the class as injection and command injection. It does not publish the command, and neither do we.
The CVSS vector shows network access, low complexity and no required privileges, so the score is 7.3 with Low impact on each of confidentiality, integrity and availability. A router that runs attacker commands sits on your network edge, so the practical risk of a working exploit is larger than those Low ratings suggest. Public exploit information makes it sensible to move quickly.
Quick check
Is there a fixed firmware for the DIR-823X?
The record does not name one. Check the D-Link support page for the DIR-823X and read the release notes before treating any build as fixed.
Is this being exploited in the wild?
The record says an exploit has been published. It is not in the CISA Known Exploited Vulnerabilities catalog, and the record does not claim active exploitation.
Sources
- Gold entry and CVE record: CVE-2026-1125.
- References listed in the record, not retrievable for this review: researcher write-up, VulDB entry and the D-Link website.
Last reviewed: 19 October 2026.
