CVE-2025-11096CWE-74CWE-77command-injection

CVE-2025-11096

Medium · published September 28, 2025

CVSS v3.1

6.3

EPSS

Percentile

90.8

In the wild

Unconfirmed

What it is

A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.04125 · 90.8th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2025-09-28T09:15Z

Affected products (1)

Product	Versions	Fixed in
dlink/dir-823x_firmware	all versions	—

References (5)

https://github.com/n1ptune/dink/blob/main/diag_traceroute.md · [email protected]https://vuldb.com/?ctiid.326177 · [email protected]https://vuldb.com/?id.326177 · [email protected]https://vuldb.com/?submit.661912 · [email protected]https://www.dlink.com/ · [email protected]

EPSS history

Timeline

28 SEP 04:32Z
D-Link DIR-823X diag_traceroute command injection
cvelistv5