CVE-2025-29635highunder attackCWE-77

CVE-2025-29635

Published · Updated

Follow this CVE+ Monitor DIR-823X

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.2epss 88%
from disclosure to weapon
Published on NVDMar 25
CISA KEV+395d
Action required by CISAfederal deadline: 2026-05-08

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

An authorized user can execute arbitrary commands on D-Link DIR-823X routers by sending a specially crafted request, potentially allowing them to take complete control of the device.

Technical detail

Command injection vulnerability in POST endpoint /goform/set_prohibiting allows authenticated attackers to inject OS commands through unsanitized input parameters. The vulnerability affects D-Link DIR-823X versions 240126 and 240802, resulting in unauthenticated remote code execution with device privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a