{"id":"CVE-2025-10123","published":"2025-09-09T02:32:10Z","modified":"2025-09-09T19:24:43Z","title":"D-Link DIR-823X set_static_leases sub_415028 command injection","vendor":"D-Link","product":"DIR-823X","tier":"core","eol":null,"affectedVersions":[{"vendor":"D-Link","product":"DIR-823X","versions":["250416"]}],"description":{"text":"A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04462,"percentile":0.91428,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-13","exploitedFirstSeen":"2026-08-13","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot","date":"2026-08-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-09&host_type=src&vulnerability=cve-2025-10123","date":"2026-10-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-30&host_type=src&vulnerability=cve-2025-10123","date":"2026-10-30"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"miniOrange WordPress SAML Auth Bypass (CVE-2026-15981 / CVE-2026-61979) Active Scanning","url":"https://otx.alienvault.com/pulse/6a91254414ce28be7487a61c","created":"2026-08-28"},{"name":"Elementor Pro CVE-2026-32475 Unauth PHP Upload RCE","url":"https://otx.alienvault.com/pulse/6a8bdf16b6e0f7552e8ec5ce","created":"2026-08-24"},{"name":"New Mirai-Based Linux Botnet 'Evooo1Bot' Turns Victims Into Proxies","url":"https://otx.alienvault.com/pulse/6a840752614dc26560c9093e","created":"2026-08-18"},{"name":"Multi-Functional Linux Botnet “Evooo1Bot”","url":"https://otx.alienvault.com/pulse/6a833514ae125f3cc03d7366","created":"2026-08-17"},{"name":"Multi-Functional Linux Botnet “Evooo1Bot”","url":"https://otx.alienvault.com/pulse/6a8334fd77aa677ff456bfd9","created":"2026-08-17"},{"name":"Multi-Functional Linux Botnet “Evooo1Bot”","url":"https://otx.alienvault.com/pulse/6a8334fc78855f417bfefa12","created":"2026-08-17"},{"name":"Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies","url":"https://otx.alienvault.com/pulse/6a82e8aa5592b7ddd68c71f6","created":"2026-08-17"},{"name":"Multi-Functional Linux Botnet \"Evooo1Bot\"","url":"https://otx.alienvault.com/pulse/6a82968f2b7eb61829fd93a5","created":"2026-08-17"},{"name":"New Mirai-Based Linux Botnet 'Evooo1Bot' Turns Victims Into Proxies","url":"https://otx.alienvault.com/pulse/6a7f349eb2e90e5a682c7e6f","created":"2026-08-14"},{"name":"Multi-Functional Linux Botnet \"Evooo1Bot\"","url":"https://otx.alienvault.com/pulse/6a7e2be6ba37cc87ae552659","created":"2026-08-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"https://vuldb.com/?id.323093","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.323093","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.645712","tags":["third-party-advisory"]},{"url":"https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md","tags":["related"]},{"url":"https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md#poc","tags":["exploit"]},{"url":"https://www.dlink.com/","tags":["product"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-27219","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27219","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md#poc"],"flow":[],"timeline":[{"date":"2025-09-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-10123","provenance":"source"},{"date":"2026-08-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":75.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 79 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.29,"detail":"percentile 0.9143"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}