CVE-2025-14208 is a medium severity command injection vulnerability in the D-Link DIR-823X router firmware up to version 20250416. The flaw exists in the /goform/set_wan_settings endpoint, specifically in the sub_415028 function, where the ppp_username parameter is improperly sanitized, allowing remote attackers to inject arbitrary commands. Exploitation does not require user interaction or authentication, making it remotely exploitable over the network. Although no known exploits are currently observed in the wild, a public exploit has been released, increasing the risk of attacks. The vulnerability impacts confidentiality, integrity, and availability by enabling command execution on the device. European organizations using this router model, especially in countries with high D-Link market penetration and critical infrastructure reliance on such devices, are at risk. Mitigation involves applying firmware updates once available, restricting WAN access to management interfaces, and monitoring network traffic for suspicious activity. Countries like Germany, France, Italy, Spain, and the UK are likely most affected due to market share and infrastructure considerations.
