CVE-2025-29635

HIGH KEV

D-Link DIR-823X 240126 and 240802 - Authenticated Remote Command Execution via /goform/set_prohibiting

Title source: llm

Exploitation Summary

CVE-2025-29635 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 24, 2026.

Description

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

References (3)

Core 3

Core References

Exploit, Third Party Advisory

https://www.akamai.com/blog/security-research/2026/apr/cve-2025-29635-mirai-campaign-targets-d-link-devices

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-29635

Exploit, Third Party Advisory

https://github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting.md

Scores

CVSS v3 7.2

EPSS 0.1995

EPSS Percentile 95.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable no

Technical Impact total

Details

CISA KEV 2026-04-24

VulnCheck KEV 2026-04-21

ENISA EUVD EUVD-2025-14821

CWE

CWE-77

Status published

Products (2)

dlink/dir-823x_firmware 240126

dlink/dir-823x_firmware 240802

Published Mar 25, 2025

KEV Added Apr 24, 2026

Tracked Since Feb 18, 2026