CVE-2025-29635
D-Link DIR-823X Command Injection Vulnerability
Description
CVE-2025-29635 is a HIGH severity command injection vulnerability in the D-Link DIR-823X consumer/SOHO router (firmware versions 240126 and 240802) with a CVSS 3.1 score of 7.2. The flaw lives in the /goform/set_prohibiting endpoint, where user-supplied input is passed into an OS command without proper neutralization, allowing an authorized attacker to execute arbitrary commands on the device by sending a crafted POST request. CISA has flagged the DIR-823X as potentially end-of-life (EoL) and end-of-service (EoS) — meaning vendor patches may not be available — and has explicitly recommended discontinuing use. CVE-2025-29635 was added to the KEV catalog on April 24, 2026 (deadline May 8, 2026), and Akamai has documented an active Mirai botnet campaign targeting D-Link devices through this vulnerability. With an EPSS score of 0.589 (98th percentile), exploitation is widespread.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-823x firmware | 240126; 240802 |
References
- https://github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting.md(Broken Link, Exploit, Third Party Advisory)
- https://www.akamai.com/blog/security-research/2026/apr/cve-2025-29635-mirai-campaign-targets-d-link-devices(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-29635(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Command Injection is a critical vulnerability that occurs when software constructs all or part of a command using externally-influenced input from an upstream component, but fails to neutralize or incorrectly neutralizes special elements that could modify the intended command when sent downstream. In the DIR-823X firmware, the function backing /goform/set_prohibiting reads attacker-controlled fields from the POST body and concatenates them into a shell command (typically used to configure the prohibition/blocking ruleset on the router) without sanitizing characters such as ;, |, &, or backticks. By embedding shell metacharacters in those fields, an authenticated attacker — and in practice an attacker who has authenticated against a default or weak credential, which is common on Mirai-targeted SOHO routers — can break out of the intended command and execute arbitrary code as root on the device.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')
Impact Analysis
CVE-2025-29635 carries a CVSS 3.1 score of 7.2 (HIGH) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — exploitable over the network with low complexity, no user interaction, but requiring high privileges (an authenticated session). On consumer and SOHO devices, however, the privilege barrier is weak: default credentials are widely known, and Mirai-style botnets routinely brute-force or replay credentials before launching the exploit. Once executed, the command runs as root on a router with full Layer-2/Layer-3 control of the user's network, granting High impact on Confidentiality (any traffic crossing the device can be inspected or rerouted), Integrity (DNS and routing tables can be poisoned), and Availability (the device can be bricked or repurposed as a botnet node). With KEV inclusion and active Mirai exploitation, the practical risk is full takeover of any internet-exposed DIR-823X with weak credentials. Because D-Link DIR-823X is potentially End-of-Life, no firmware fix may ever ship, which makes this vulnerability effectively unfixable — CISA's required action is to discontinue use.
Exploit Maturity
Public Exploits and Active Botnet Campaigns: Public exploit code and reverse-engineering details are available — see the original write-up at github.com/mono7s/Dir-823x (note: tagged as broken link in NVD references) and Akamai's threat-research analysis "CVE-2025-29635: Mirai Campaign Targets D-Link Devices", which documents real-world Mirai botnet activity using this vulnerability. Active Exploitation: CISA confirmed in-the-wild exploitation by adding CVE-2025-29635 to the KEV catalog on April 24, 2026, with a remediation deadline of May 8, 2026. Exploitation Probability: The EPSS score of 0.589 (98th percentile) indicates a near-certain probability of continued exploitation — consistent with Mirai-class botnets that scan IPv4 space continuously for vulnerable devices. End-of-Life Status: Because D-Link has flagged the DIR-823X as potentially EoL/EoS, defenders should assume that no patch will be released and that any device left online will eventually be compromised.
Remediation
- Discontinue use of D-Link DIR-823X — apply the KEV required action. Per CISA: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable." Because the DIR-823X is potentially end-of-life, replacement with a supported router is the primary remediation. Check the D-Link security advisory SAP10469 for vendor guidance.
- If immediate replacement is impossible, isolate the device. Disable WAN-side management, remove any port-forwarding rules that expose the admin interface, and if possible place the router behind a separate, supported edge firewall.
- Change default credentials and audit local access. Mirai-class botnets exploit CVE-2025-29635 only after acquiring valid admin credentials. Replace default username/password combinations with long, unique passwords, and disable remote administration (HTTP/HTTPS WAN access, UPnP exposure of the admin port).
- Detection: hunt for Mirai indicators. Look for outbound connections from the router to known Mirai C2 ranges, abnormal DNS query volumes, ICMP/SYN-flood patterns originating from the router, or unusual traffic on TCP/23/2323 (telnet) and TCP/7547 (TR-069) — see Akamai's Mirai write-up for IOCs.
- Long-term hardening. Apply the CWE-77 mitigation principles — never trust router configuration data sourced from network input. For organizations with many SOHO endpoints, deploy a vendor-managed gateway that receives security updates and avoid devices flagged as EoL/EoS — see the CWE-77 mitigation guide for additional defensive measures.
Technical Details
CVE-2025-29635 is a CWE-77 command injection in the D-Link DIR-823X router firmware versions 240126 and 240802. The vulnerable handler responds to authenticated POST requests at /goform/set_prohibiting, which is the configuration endpoint for the router's prohibition/blocking ruleset. The handler reads parameter values from the POST body and concatenates them into a shell command — likely an iptables, ebtables, or comparable ruleset-update invocation — without sanitizing shell metacharacters such as ;, |, &, $(), or backticks. By embedding any of those characters in a controlled field, an attacker breaks out of the intended command and executes arbitrary commands as the router's root process. The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the network-reachable, low-complexity nature of the request and the High impact across all three CIA properties. The required "high privileges" rating (PR:H) reflects the need for a valid admin session, but in real Mirai campaigns this barrier is bypassed by credential-stuffing or default-credential reuse before the exploit is fired. Because router firmware typically stores its WAN configuration, DNS settings, and traffic-routing tables in plaintext on the device, root-level command execution is sufficient to fully control the user's network.
Frequently Asked Questions
Is CVE-2025-29635 being actively exploited?
Yes. CISA added CVE-2025-29635 to the Known Exploited Vulnerabilities catalog on April 24, 2026, and Akamai has published research showing the Mirai botnet using it to compromise D-Link DIR-823X devices in the wild. The EPSS score of 0.589 (98th percentile) indicates near-certain ongoing exploitation.
What products are affected by CVE-2025-29635?
The D-Link DIR-823X router is vulnerable in firmware versions 240126 and 240802. CISA notes the device is potentially end-of-life and end-of-service, meaning a vendor patch may never be released. Refer to D-Link advisory SAP10469 for any official guidance.
How do I fix CVE-2025-29635?
The primary remediation, in line with CISA's KEV required action, is to discontinue use of the DIR-823X and replace it with a supported router. As an interim measure, change all default credentials, disable WAN-side administration, and segment the device behind a supported edge firewall.
How severe is CVE-2025-29635?
CVE-2025-29635 is rated HIGH (CVSS 3.1 score 7.2) with full High impact on Confidentiality, Integrity, and Availability. Combined with KEV inclusion, EoL status, and active Mirai exploitation, defenders should treat any internet-reachable DIR-823X as imminently at risk of compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.