CVE-2025-1103CWE-404CWE-476

D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereference

High · published February 7, 2025

CVSS v4.0

7.1

EPSS

14%

Percentile

96.6

In the wild

Unconfirmed

What it is

A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blacklists of the file /goform/set_wifi_blacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

The record

Technical detail

CVSS v4.0: 7.1 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.14066 · 96.6th percentile
Weaknesses: CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published: 2025-02-07T15:00Z

EPSS history

Timeline

07 FEB 15:00Z
D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereference
cvelistv5