CVE-2026-1544 is an OS command injection vulnerability identified in the D-Link DIR-823X router, version 250416. The vulnerability resides in the function sub_41E2A0 within the /goform/set_mode endpoint, where the lan_gateway parameter is improperly sanitized. This flaw allows an attacker to inject arbitrary operating system commands remotely without requiring authentication or user interaction. The vulnerability is exploitable over the network, making it a significant risk for exposed devices. The CVSS 4.0 base score is 5.3 (medium), reflecting the ease of exploitation (network vector, low attack complexity) but limited impact on confidentiality, integrity, and availability (low to low impact). The product affected is no longer supported by the vendor, and no patches or official mitigations have been released. A public exploit is available, increasing the likelihood of exploitation by threat actors. The lack of vendor support means that affected devices remain vulnerable unless replaced or protected by external controls. This vulnerability could be leveraged to gain control over the router, enabling attackers to manipulate network traffic, launch further attacks within the network, or exfiltrate sensitive information.

For European organizations, the exploitation of this vulnerability could lead to unauthorized control over affected routers, resulting in network traffic interception, redirection, or disruption. Compromised routers could serve as footholds for lateral movement within corporate networks or as platforms for launching attacks against other internal or external targets. The impact is particularly concerning for organizations relying on the DIR-823X in critical infrastructure, small and medium enterprises, or home office environments where these devices are commonly deployed. Since the device is no longer supported, organizations cannot rely on vendor patches, increasing the risk of prolonged exposure. This could lead to data breaches, loss of network availability, and reputational damage. Additionally, attackers could use compromised routers to create botnets or conduct denial-of-service attacks, affecting broader network stability.

Given the absence of vendor patches, the primary mitigation is to replace the affected D-Link DIR-823X devices with supported and updated hardware. Until replacement is feasible, organizations should implement strict network segmentation to isolate vulnerable routers from critical systems and sensitive data. Deploying firewall rules to restrict access to the router’s management interfaces, especially blocking inbound traffic to the /goform/set_mode endpoint, can reduce exposure. Monitoring network traffic for unusual patterns or command injection attempts targeting the lan_gateway parameter is advisable. Employing intrusion detection/prevention systems (IDS/IPS) with signatures for this vulnerability can help detect exploitation attempts. Regularly auditing network devices to identify unsupported or vulnerable hardware is critical. Educating users about the risks of using unsupported devices and enforcing policies to phase out such equipment will reduce future risks.