CVE-2025-29635: D-Link DIR-823X command injection in set_prohibiting

CVE-2025-29635 · Severity: critical · CVSS 7.2 · Exploited in the wild · Published 2026-04-24

A command injection vulnerability exists in D-Link DIR-823X routers, which are networking devices used to provide internet connectivity. An attacker with administrative access can take complete control of the device to execute unauthorized commands, potentially leading to data interception or using the device as a foothold for further attacks. This vulnerability is currently being exploited in the wild, and because the product may be at its end-of-life, users are advised to replace the hardware.

Vendors: D-Link.

Quick answers

Is CVE-2025-29635 exploited in the wild?
Yes. CVE-2025-29635 is known to be exploited in the wild, first recorded on 24 April 2026. Treat it as urgent.
How severe is CVE-2025-29635?
Critical severity, with a CVSS score of 7.2, published 24 April 2026.
Which products and versions are affected?
D-Link DIR-823X firmware 240126, 240802.
Is there a fix for CVE-2025-29635?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-29635 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2025-29635?
Check whether you run D-Link DIR-823X or D-Link DIR-823X firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability (CWE-77) exists in the D-Link DIR-823X router firmware versions 240126 and 240802. The flaw is located within the handling of POST requests to the /goform/set_prohibiting endpoint, where unsanitized input is passed to a system shell. An attacker with high privileges (administrative access) can exploit this over the network to achieve remote code execution (RCE) on the underlying operating system. This vulnerability has been observed in active exploitation, notably by Mirai-based botnets. As the device is potentially End-of-Life (EoL), no official patch may be available, and CISA recommends discontinuing use.

Affected products

  • D-Link DIR-823X firmware 240126, 240802

Timeline

  • 2025-03-25: disclosed: Initial CVE publication
  • 2026-04-24: kev added: CISA added to Known Exploited Vulnerabilities catalog due to Mirai campaign activity
  • 2026-04-24: exploited: Reports of active exploitation in Mirai botnet campaigns

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.