Threat Intelligence / CVE / CVE-2026-2143

CVE-2026-2143 — Dlink Dir-823x Firmware 250416

CVSS v3.1 7.2 (HIGH) · CVSS v4.0 7.3 · EPSS 0.1% (higher than 29.9% of all scored CVEs) · Priority 4.8/10 · Published 2026-02-08

As of 2026-02-10, CVE-2026-2143 is a HIGH-severity vulnerability in Dlink Dir-823x Firmware 250416, CVSS v3.1 7.2, EPSS 0.1% (29.9th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-2143, most recently “CVE-2025-29635 — Mirai Variant Campaign Recruiting D-Link DIR-823X Routers via /goform/set_prohibiting Command Injection”.

Last updated: 2026-02-10

What is CVE-2026-2143?

A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddns of the component DDNS Service. The manipulation of the argument ddnsType/ddnsDomainName/ddnsUserName/ddnsPwd leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

The record classifies CVE-2026-2143 under weakness classes CWE-77, CWE-78. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs high-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 2 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 217 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 7.2 — HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 base score: 7.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (FIRST): 0.1% probability of exploitation in the next 30 days, higher than 29.9% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 4.8/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-02-08, last modified 2026-02-10

Is CVE-2026-2143 being exploited?

It currently carries a trending score of 12 in the Threadlinqs vulnerability feed.

Affected products and versions

Dlink: Dir-823x Firmware 250416, Dir-823x

How to fix CVE-2026-2143

Vendor advisory: https://www.dlink.com/. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2026-2143

1 tracked threat in the Threadlinqs corpus references CVE-2026-2143, either in the campaign’s CVE list or as an indicator on the campaign record.

CVE-2025-29635 — Mirai Variant Campaign Recruiting D-Link DIR-823X Routers via /goform/set_prohibiting Command Injection — HIGH · 2026-04-21

Sources

Seeded from nvd and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2026-2143 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence