CVE-2025-29635: D-Link DIR-823X command injection in set_prohibiting handler

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is confirmed exploited in the wild, listed in CISA KEV with a near-term due date, and carries a very high EPSS score, making it an urgent patching priority.

What it is

D-Link DIR-823X firmware (240126 and 240802) contains a command injection flaw in the /goform/set_prohibiting POST handler. An attacker who already holds valid credentials can inject and execute arbitrary commands on the device. Because the device is internet-facing in many deployments, successful exploitation gives full control of the router.

Impact

An authenticated attacker gains arbitrary command execution on the device, allowing full compromise of the router, traffic interception or redirection, and use of the device as a foothold into the network.

Attack surface

Reached remotely over the network via an HTTP POST to /goform/set_prohibiting. The CVSS vector (PR:H) indicates valid credentials are required; no user interaction is needed.

Exploitation

CVE-2025-29635 is listed in CISA KEV with a 2026-05-08 remediation due date, and EPSS shows a 30-day probability of roughly 0.88 (99.8th percentile). References include exploit write-ups and an Akamai report describing a Mirai campaign targeting D-Link devices, so active exploitation is confirmed.

What to do

• Apply the vendor's patched firmware for DIR-823X; if no fix is available, discontinue use or replace the device per CISA KEV guidance.
• Remove or restrict internet exposure of the router's management interface; block external access to /goform/ endpoints.
• Change default and weak administrative credentials and enforce strong unique passwords, since exploitation requires authentication.
• Segment IoT and router management traffic from trusted internal networks to limit lateral movement if the device is compromised.
• Monitor vendor advisories and CISA KEV for updated remediation deadlines and replacement guidance.

Detection

• Inspect HTTP logs for POST requests to /goform/set_prohibiting, especially from unexpected or external source IPs.
• Alert on shell metacharacters or command strings in parameters sent to /goform/set_prohibiting.
• Monitor router outbound traffic for connections to known Mirai C2 infrastructure or unusual scanning behavior.
• Watch for unexpected processes, cron entries, or configuration changes on the device that indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.