CVE-2025-29635

What it actually does

CVE-2025-29635 is an authenticated command injection flaw in D-Link DIR-823X firmware versions 240126 and 240802. An attacker with valid administrative access to the router management interface can send a crafted POST request to /goform/set_prohibiting and cause the device to execute attacker-supplied operating-system commands. Successful exploitation can provide full control of the router at the privileges of the vulnerable web management process, enabling configuration tampering, malware installation, packet interception, persistence, lateral movement support, and denial of service.

Why it matters to the business

Compromised edge routers can disrupt internet connectivity, expose traffic passing through the device, weaken perimeter security, and be enrolled into botnets such as Mirai-based campaigns for DDoS or further attacks. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score, organizations using affected D-Link DIR-823X devices should treat exposure as urgent even though exploitation requires authentication. CISA’s remediation due date is 2026-05-08 for covered organizations.

How an attack unfolds

An attacker first obtains access to the D-Link DIR-823X management interface, typically by using default credentials, reused credentials, previously stolen router passwords, or access from an already-compromised internal host. The attacker then sends a crafted authenticated POST request to /goform/set_prohibiting containing shell metacharacters or command payloads accepted by the vulnerable handler. The router’s web process passes unsafe input to the underlying operating system, causing arbitrary commands to run. In observed threat context, Mirai-based malware campaigns commonly use this kind of router RCE to download architecture-specific payloads, modify device settings, disable competing malware, open remote access, and join the device to a botnet.

How to fix it

Upgrade affected D-Link DIR-823X firmware to a vendor-provided fixed release when available. No fixed versions were provided in the input, so administrators should check D-Link security advisories and firmware download pages for DIR-823X updates newer than affected builds 240126 and 240802. If no fixed firmware is available, remove or replace the affected device, disable WAN-side administration, restrict management access to a dedicated trusted management network or VPN, enforce strong unique administrator credentials, disable unused services, and block unsolicited inbound access to the router management interface. Rebooting may remove memory-resident malware but is not sufficient remediation if the vulnerable firmware remains in use or credentials are still compromised.

How to confirm the fix worked

Confirm the router model and firmware version through the administrative interface, device inventory, configuration backup, or network management tooling. Devices running D-Link DIR-823X firmware 240126 or 240802 should be considered affected. After remediation, verify that the firmware version is newer than the affected builds or that the device has been replaced. Confirm that the management interface is not reachable from the internet, that administrative access is limited to trusted source addresses, and that default credentials are disabled. Where safe and authorized, perform an authenticated configuration test against /goform/set_prohibiting to confirm command separators are rejected and no command execution occurs. Review firewall, reverse proxy, IDS, and device logs for historical POST requests to /goform/set_prohibiting, especially requests containing shell metacharacters, command names, or download utilities.

Typical attack path

1. Identify D-Link DIR-823X devices exposed to the internet or reachable from a compromised network segment.
2. Access the web management interface using valid, default, reused, or stolen credentials.
3. Confirm the device is running affected firmware such as 240126 or 240802.
4. Send a crafted authenticated POST request to /goform/set_prohibiting containing command-injection syntax.
5. Execute shell commands on the router, often to retrieve and run a malware payload using wget, curl, tftp, or busybox.
6. Establish persistence or re-execute malware after reboot where possible, modify configuration, and enroll the router into botnet infrastructure.
7. Use the compromised router for DDoS traffic, proxying, reconnaissance, traffic interception, or as a foothold into adjacent networks.

How to detect it

Investigate historical access to the D-Link DIR-823X management interface. Key log sources include router web administration logs if available, upstream firewall and NAT logs, VPN logs for management access, reverse proxy logs if the interface is proxied, IDS/IPS alerts, DNS resolver logs, NetFlow/IPFIX records, and EDR/NDR telemetry that observes traffic to or from the router. Search for POST requests to /goform/set_prohibiting, particularly authenticated requests with URL-encoded shell metacharacters such as ;, |, &, `, $(), newline encodings, or command names such as wget, curl, tftp, busybox, chmod, sh, nc, telnetd, or rm. Examine outbound connections from the router shortly after suspicious requests, especially HTTP/TFTP downloads, connections to unfamiliar IPs, high-volume outbound traffic, scanning behavior, or DDoS-like traffic. On the device, review configuration for unexpected admin accounts, changed DNS settings, port forwards, remote management enablement, startup scripts, unknown files in writable temporary directories, and suspicious processes. Because many consumer routers have limited logging and Mirai-like malware may be memory-resident, absence of logs does not prove absence of compromise; treat unexplained exposure plus affected firmware as a reason to reset, upgrade or replace, and rotate credentials.

• POST /goform/set_prohibiting
• /goform/set_prohibiting
• %3Bwget
• ;wget
• %3Bcurl
• ;curl
• %3Btftp
• ;tftp
• %7Cwget
• |wget
• %7Ccurl
• |curl
• %7Ctftp
• |tftp
• busybox wget
• busybox tftp
• chmod +x
• /tmp/
• /var/tmp/
• telnetd
• /bin/sh
• /bin/busybox
• D-Link DIR-823X firmware 240126
• D-Link DIR-823X firmware 240802

What your security team should do

• Immediately inventory D-Link DIR-823X routers and identify firmware versions 240126 and 240802.
• Prioritize remediation because the vulnerability is in CISA KEV, has active exploitation, and has a high EPSS likelihood of exploitation.
• Remove internet exposure for router administration interfaces and restrict management access to trusted administrative networks or VPN only.
• Change administrator passwords and eliminate default, shared, or reused credentials on affected devices.
• Upgrade to a fixed firmware release if available; if no fixed release is available, replace or decommission affected devices.
• Hunt for prior exploitation by reviewing HTTP management logs, firewall logs, IDS alerts, DNS logs, and outbound connection records from router IP addresses.
• Look for Mirai-style post-exploitation behavior, including downloads of binaries using wget, curl, tftp, ftpget, or busybox and outbound connections to unusual high-risk destinations.
• Reboot affected devices only as a containment step after collecting available evidence; follow with firmware upgrade, credential rotation, and exposure reduction.
• Add SIEM/IDS detections for authenticated POST requests to /goform/set_prohibiting containing command separators or shell commands.
• For CISA-covered environments, track remediation against the KEV due date of 2026-05-08.