Vulnerability intelligence
CVE-2025-29635
D-Link DIR-823X Command Injection Vulnerability
D-Link DIR-823X
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
CVSS Score
7.2
High
EPSS — Exploit Probability
87%
Riskier than 100% of all CVEs
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
unknown
Federal deadline 2026-05-08
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-05-08.
7 articles across 5 outlets · first covered Apr 22, 2026 · latest Apr 25, 2026
Tracked incidents
Coverage timeline
-
CISA Adds KEV Entries for Samsung, SimpleHelp, DLink Flawssecurityaffairs.com · Apr 25, 2026
-
CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadlinethehackernews.com · Apr 25, 2026
-
CISA Adds Four New KEV Flaws, Urges Immediate Patchingwww.cisa.gov · Apr 24, 2026
-
CISA Adds D Link Router Flaw to KEV, Urges Immediate Actionwww.cisa.gov · Apr 24, 2026
-
CISA Adds CVE-2025-29635 to Known Exploited Vulnerabilities Cataloguecisa.gov · Apr 24, 2026
-
Mirai Botnet Hijacks Old DLink Routers Via CVE-2025-29635securityaffairs.com · Apr 22, 2026
-
Mirai botnet exploits old D Link routers via CVE-2025-29635 flawwww.securityweek.com · Apr 22, 2026