High severity · published Feb 7, 2026
CVE-2026-2084
D-Link DIR-823X set_language os command injection
7.2
CVSS
4.6%
EPSS
No
On KEV
Description
A weakness has been identified in D-Link DIR-823X 250416. This impacts an unknown function of the file /goform/set_language. Executing a manipulation of the argument langSelection can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
DIR-823X · D-Link
250416 · source: vendor
DF
Dir-823x Firmware · Dlink
250416 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2084
Exploit
https://github.com/master-abc/cve/issues/24
Permissions Required
https://vuldb.com/?ctiid.344651
Third Party Advisory
https://vuldb.com/?id.344651
Third Party Advisory
https://vuldb.com/?submit.746379
Third Party Advisory
https://vuldb.com/?submit.746380
Product
https://www.dlink.com/
More from DIR-823X
7.2
CVE-2025-29635
D-Link DIR-823X Command Injection Vulnerability
9.8
CVE-2026-1125
D-Link DIR-823X set_wifidog_settings sub_412E7C command injection
8.8
CVE-2026-1544
D-Link DIR-823X set_mode sub_41E2A0 os command injection
7.2
CVE-2026-2210
D-Link DIR-823X set_filtering sub_4211C8 os command injection
7.2
CVE-2026-2175
D-Link DIR-823X set_upnp sub_420618 os command injection