D-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorization

published 2025-03-17 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-6459

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 15.4%; EPSS 15.4% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

A vulnerability classified as critical has been found in D-Link DIR-823G 1.0.2B05_20181207. Affected is the function SetDDNSSettings of the file /HNAP1/ of the component DDNS Service. The manipulation of the argument SOAPAction leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 19 mo ago (2025-03-17)

Exploit prediction

15.40% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

lavender-bicycle-a5a.notion.site https://lavender-bicycle-a5a.notion.site/D-Link-DIR-823G-SetDDNSSettings-1ac53a41781f80d98649dd3cbe106e9b?pvs=4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	3.0	7.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

D-Link DIR-823G

Classification

Weakness

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

References

lavender-bicycle-a5a.notion.site /D-Link-DIR-823G-SetDDNSSettings-1ac53a41781f80d98649dd3cbe106e9b?pvs=4
exploit, third-party-advisory
vuldb.com /?id.299826
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.299826
signature, permissions-required, vdb-entry
vuldb.com /?submit.513750
third-party-advisory, vdb-entry
dlink.com /
product

Sources

CVE List CVE-2025-2359
NVD CVE-2025-2359

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary