Mirai Botnet exploits CVE-2025-29635 to target legacy D
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data. Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic. | 8.8 | 100% | KEV PoC ×2 |
| masslikely hundreds of thousands of routers deployed, with >100k plausibly internet-exposed | |
| CVE-2025-29635 | Authenticated Command Injection in D-Link DIR-823X Routers Exploited by Mirai Botnet CVE-2025-29635 is a command injection flaw (CWE-77) in D-Link DIR-823X router firmware builds 240126 and 240802 that permits arbitrary command execution on the device. It is triggered by sending a crafted POST request to the /goform/set_prohibiting endpoint, and because the flaw requires high privileges (CVSS PR:H), the attacker must hold valid administrative credentials, which in botnet campaigns is typically achieved via default or weak passwords. Successful exploitation yields full remote command execution on the router, which in the observed campaign has been used by Mirai-variant botnets to enroll devices for DDoS activity. Any DIR-823X running the listed firmware builds is affected, with exposure concentrated in units whose web administration interface is reachable from the internet. The flaw was added to CISA's KEV catalog on 2026-04-24 after documented in-the-wild exploitation (an Akamai report on a Mirai campaign and a public PoC), and its EPSS score of 87.9% places it in the top percentile for near-term exploitation risk. Do: Apply updated DIR-823X firmware per D-Link's guidance (a fixed build is not specified in this data) or the applicable BOD 22-01 mitigation deadline, reported as May 2026 for federal agencies. Until patched, ensure the router's admin interface is not exposed to the WAN and change default/weak credentials, since exploitation requires valid administrative access. Check devices for indicators of Mirai-style compromise (unexpected processes, outbound scanning or DDoS traffic) and review logs for POST requests to /goform/set_prohibiting from untrusted sources. | 7.2 | 88% | KEV PoC ×2 |
| moderatelikely thousands of internet-exposed DIR-823X routers (roughly 1k-10k units directly attackable; installed base of the model could be higher) |
Full article495 words · extracted from securityaffairs.com · click to collapse
Mirai botnet is targeting old D-Link routers using CVE-2025-29635, a command injection flaw exploitable via crafted POST requests after public PoC disclosure.
A Mirai botnet is actively exploiting a command injection vulnerability, tracked as CVE-2025-29635, in discontinued D-Link routers, Akamai reports. The flaw allows attackers to inject commands because an attacker-controlled value is copied without proper validation. The vulnerability impacts firmware versions 240126 and 24082 of D-Link DIR-823X series routers.
The experts observed that exploitation began about a year after public disclosure and PoC release, using crafted POST requests to compromise devices.
“The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of command injection vulnerability CVE-2025-29635 against D-Link DIR-823X series routers. Although the devices were discontinued in 2025, threat actors are using this flaw to deploy Mirai botnet variants.” reads the report published by Akamai.
“The SIRT first identified this activity in our global network of honeypots in March 2026. This is the first reported active exploitation of these vulnerabilities since their initial disclosures in March 2025. “
Security researchers Wang Jinshuai and Zhao Jiangting reverse engineered the firmware’s sub_42232C function and found that attacker-controlled macaddr input is copied into a command buffer with snprintf and then passed to system(), enabling remote command execution via a crafted POST request to /goform/set_prohibiting.
They also published a PoC on GitHub, later removed, while the issue was still absent from CISA’s Known Exploited Vulnerabilities catalog at the time of the report. In early March 2026, Akamai SIRT observed active exploitation attempts using similar request patterns, including shell commands that fetch and execute malware from external infrastructure.
A simple shell script drops a Mirai variant (“tuxnokill”) from 88.214.20[.]14, supporting multiple architectures. The payload uses XOR encoding (key 0x30), includes standard Mirai strings, and contacts C2 at 64.89.161[.]130:44300. Hard-coded elements suggest manual development. The actor also exploits CVE-2025-29635, CVE-2023-1389 (TP-Link AX21), and a ZTE ZXV10 H108L RCE.
Mirai campaigns persist as attackers reuse its leaked code, lowering the barrier to entry and attracting both skilled and inexperienced actors seeking profit. While some threat actors reject AI, others increasingly adopt it to develop malware or discover vulnerabilities. AI thus represents both a growing risk in cybercrime and a valuable tool for defenders.
“many threat actors in the botnet space frequently target older vulnerabilities. Especially when public PoC exploits exist for these vulnerabilities, attackers can easily incorporate them into their exploitation vectors.” concludes the report that includes Indicators of Compromise (IoCs) along with Yara rules for malware samples. “Unfortunately, many organizations globally will improperly configure devices, fail to patch in a timely manner, or continue to use vulnerable devices that have been retired, as in the case with D-Link 823X series routers. We highly recommend that organizations regularly monitor vulnerability disclosures that are relevant to their infrastructure, and apply the proper patches, upgrades, and safeguards to ensure their own operational security.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Mirai)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/191135/malware/mirai-botnet-exploits-cve-2025-29635-to-target-legacy-d-link-routers.html