Medium severity · published Jan 30, 2026
CVE-2026-1685
D-Link DIR-823X Login sub_40AC74 excessive authentication
5.9
CVSS
1.2%
EPSS
No
On KEV
Description
A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the component Login. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
DIR-823X · D-Link
250416 · source: vendor
DF
Dir-823x Firmware · Dlink
250416 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1685
Issue Tracking
https://github.com/master-abc/cve/issues/17
Permissions Required
https://vuldb.com/?ctiid.343479
Third Party Advisory
https://vuldb.com/?id.343479
Third Party Advisory
https://vuldb.com/?submit.740886
Product
https://www.dlink.com/
More from DIR-823X
7.2
CVE-2025-29635
D-Link DIR-823X Command Injection Vulnerability
9.8
CVE-2026-1125
D-Link DIR-823X set_wifidog_settings sub_412E7C command injection
9.8
CVE-2025-10123
D-Link DIR-823X set_static_leases sub_415028 command injection
8.8
CVE-2026-1544
D-Link DIR-823X set_mode sub_41E2A0 os command injection
8.8
CVE-2025-11100
D-Link DIR-823X set_wifi_blacklists uci_set command injection