CVE-2025-11100CWE-74CWE-77command-injection

CVE-2025-11100

Medium · published September 28, 2025

CVSS v3.1

6.3

EPSS

Percentile

90.8

In the wild

Unconfirmed

What it is

A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.04125 · 90.8th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2025-09-28T11:15Z

Affected products (1)

Product	Versions	Fixed in
dlink/dir-823x_firmware	all versions	—

References (5)

https://github.com/n1ptune/dink/blob/main/uci_set.md · [email protected]https://vuldb.com/?ctiid.326181 · [email protected]https://vuldb.com/?id.326181 · [email protected]https://vuldb.com/?submit.661917 · [email protected]https://www.dlink.com/ · [email protected]

EPSS history

Timeline

28 SEP 06:32Z
D-Link DIR-823X set_wifi_blacklists uci_set command injection
cvelistv5