CVE-2025-29635

CVE-2025-29635 is a command injection flaw (CWE-77) in D-Link DIR-823X router firmware builds 240126 and 240802 that permits arbitrary command execution on the device. It is triggered by sending a crafted POST request to the /goform/set_prohibiting endpoint, and because the flaw requires high privileges (CVSS PR:H), the attacker must hold valid administrative credentials, which in botnet campaigns is typically achieved via default or weak passwords. Successful exploitation yields full remote command execution on the router, which in the observed campaign has been used by Mirai-variant botnets to enroll devices for DDoS activity. Any DIR-823X running the listed firmware builds is affected, with exposure concentrated in units whose web administration interface is reachable from the internet. The flaw was added to CISA's KEV catalog on 2026-04-24 after documented in-the-wild exploitation (an Akamai report on a Mirai campaign and a public PoC), and its EPSS score of 87.9% places it in the top percentile for near-term exploitation risk.

What to do: Apply updated DIR-823X firmware per D-Link's guidance (a fixed build is not specified in this data) or the applicable BOD 22-01 mitigation deadline, reported as May 2026 for federal agencies. Until patched, ensure the router's admin interface is not exposed to the WAN and change default/weak credentials, since exploitation requires valid administrative access. Check devices for indicators of Mirai-style compromise (unexpected processes, outbound scanning or DDoS traffic) and review logs for POST requests to /goform/set_prohibiting from untrusted sources.