CVE-2025-29635
Published: 25 March 2025
Summary
CVE-2025-29635 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Dir-823X Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-29635 is a command injection vulnerability in D-Link DIR-823X devices running firmware versions 240126 and 240802. The issue occurs in the set_prohibiting function, where specially crafted input submitted via a POST request to /goform/set_prohibiting results in execution of attacker-controlled commands on the device. It is tracked under CWE-77 and carries a CVSS 3.1 score of 7.2.
An attacker who already possesses administrative credentials can exploit the flaw remotely over the network to achieve arbitrary command execution, granting full control over the affected router with impacts to confidentiality, integrity, and availability.
The vulnerability appears in the CISA Known Exploited Vulnerabilities catalog. Public reporting from Akamai describes active use of the flaw in Mirai botnet campaigns that target D-Link devices. The associated EPSS score rose materially from lower values to a peak of 0.6969 on 2026-04-29 before receding to the current 0.1995.
Technical details of the injection vector are documented in a public GitHub repository.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14821
Vulnerability details
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
- CWE(s)
- KEV Date Added
- 24 April 2026
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in web management endpoint (/goform/set_prohibiting) on exposed router enables exploitation of public-facing application for initial access (T1190) and arbitrary command execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the specific command injection flaw in D-Link DIR-823X firmware versions 240126 and 240802 to eliminate the vulnerability.
Mandates validation and sanitization of inputs to the /goform/set_prohibiting POST endpoint to directly block command injection attacks.
Enables detection of firmware modifications or integrity violations resulting from exploitation, such as Mirai botnet infections.