CVE-2025-29635

HIGH KEV

Dlink Dir-823x Firmware - Command Injection

Title source: rule

Description

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

References (3)

[Exploit, Third Party Advisory] https://www.akamai.com/blog/security-research/2026/apr/cve-2025-29635-mirai-campaign-targets-d-link-devices

[US Government Resource] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-29635

[Exploit, Third Party Advisory] https://github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting.md

Scores

CVSS v3 7.2

EPSS 0.0125

EPSS Percentile 79.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2026-04-24

VulnCheck KEV 2026-04-21

CWE

CWE-77

Status published

Products (2)

dlink/dir-823x_firmware 240126

dlink/dir-823x_firmware 240802

Published Mar 25, 2025

KEV Added Apr 24, 2026

Tracked Since Feb 18, 2026