CVE-2019-7297

9.8 criticalEPSS 12%

Critical (9.8) in d-link dir-823g firmware. EPSS 12% chance of exploitation in the next 30 days.

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system function with an untrusted input parameter named Address. Consequently, an attacker can execute any command remotely when they control this input.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2019-01-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

d-link:dir-823g_firmware

References

http://www.securityfocus.com/bid/106815
https://github.com/leonW7/D-Link/blob/master/Vul_1.md
http://www.securityfocus.com/bid/106815
https://github.com/leonW7/D-Link/blob/master/Vul_1.md

Check your stack JSON