In CISA KEV7.2 High
CVE-2025-29635
D-Link DIR-823X Command Injection Vulnerability
D-LinkDIR-823X
Status
- Exploited in the wild
- In CISA KEV since 24 Apr
Federal deadlineFri 8 May, 23:59 UTC
Passed 169 days ago
CISA KEV · added 24 Apr
Exploit probabilityEPSSchecked 21 Oct
88%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
7.2High
Description NVD
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 7 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 22 Apr · 12:08 UTC | SecurityWeek | Mirai botnet exploits old D Link routers via CVE-2025-29635 flaw |
| Wed 22 Apr · 18:01 UTC | Security Affairs | Mirai Botnet Hijacks Old DLink Routers Via CVE-2025-29635 |
| Fri 24 Apr · 17:51 UTC | CISA | CISA Adds CVE-2025-29635 to Known Exploited Vulnerabilities Catalogue |
| Fri 24 Apr · 17:58 UTC | CISA | CISA Adds D Link Router Flaw to KEV, Urges Immediate Action |
| Fri 24 Apr · 19:11 UTC | CISA | CISA Adds Four New KEV Flaws, Urges Immediate Patching |
| Sat 25 Apr · 06:30 UTC | The Hacker News | CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline |
| Sat 25 Apr · 22:21 UTC | Security Affairs | CISA Adds KEV Entries for Samsung, SimpleHelp, DLink Flaws |
- CISA Adds KEV Entries for Samsung, SimpleHelp, DLink FlawsSecurity Affairs · mentions it in passing
- CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal DeadlineThe Hacker News · mentions it in passing
- CISA Adds Four New KEV Flaws, Urges Immediate PatchingCISA · official notice · mentions it in passing
- CISA Adds D Link Router Flaw to KEV, Urges Immediate ActionCISA · official notice
- CISA Adds CVE-2025-29635 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- Mirai Botnet Hijacks Old DLink Routers Via CVE-2025-29635Security Affairs
- Mirai botnet exploits old D Link routers via CVE-2025-29635 flawSecurityWeek · first in our coverage