CVE-2025-10123

This vulnerability is like leaving a hidden “back door” in a router’s management feature. If someone can reach that feature over the internet, they can trick the router into running unintended commands.

In a small business, that can mean an attacker gaining control of your network settings and causing disruption or interception.

This matters if you use D-Link DIR-823X and its firmware is at or below 250416. It specifically targets a router web feature used to set “static leases.”

It’s a risk when the vulnerable router endpoint is reachable remotely—especially if management or the relevant web interface is exposed to the internet.

This is RED because there’s publicly available exploitation material (a public proof-of-concept) and sustained press/incident attention pointing to real-world risk. Attackers don’t need special tricks beyond reaching the router and using the vulnerable input to trigger command injection.

Prioritize blocking internet access to router management immediately, then apply the vendor’s fixed firmware update as soon as you can.