CVE-2026-11492: D-Link DIR-823G vsftpd vsftpd.conf least privilege violation
A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the device's FTP service (vsftpd). Block inbound FTP (TCP/21) and related management ports from untrusted networks at network perimeter/firewall and allow only trusted IPs.
- Compensating control
If possible, disable or stop the vsftpd service on affected D-Link DIR-823G devices (version 1.0.2B05) until a vendor-supplied patch or mitigation is available.
- Operational
Monitor FTP and system logs on the affected device for signs of exploitation (unauthorized logins, unexpected privilege changes, suspicious file changes). Isolate any devices showing evidence of compromise.
- Operational
Rotate credentials and administrative passwords, and any keys or secrets that may have been exposed or elevated due to the vulnerability or confirmed exploitation.
- Operational
Apply vendor-supplied updates or advisories for D-Link DIR-823G (1.0.2B05) as soon as a fix is released; follow the vendor remediation guidance and validate the update on test devices before wide deployment.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11492?
The severity of CVE-2026-11492 is rated as medium with a score of 4.3.
What components are affected by CVE-2026-11492?
CVE-2026-11492 affects the D-Link DIR-823G and the vsftpd configuration file /etc/vsftpd.conf.
How can CVE-2026-11492 be exploited?
CVE-2026-11492 can be exploited remotely by manipulating the vsftpd configuration, leading to a least privilege violation.
What type of vulnerability is CVE-2026-11492?
CVE-2026-11492 is categorized as a least privilege violation vulnerability.
How do I fix CVE-2026-11492?
To fix CVE-2026-11492, update the D-Link DIR-823G firmware to the latest version provided by the manufacturer.