CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability

Vulnerability summary

CVE-2025-29635 is a high (CVSS 7.2) Command Injection vulnerability in D-Link DIR-823X. It is known to be exploited: CISA lists it, first on 24-04-2026. EPSS estimates a 87.94% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 25-03-2025
   PublishedVulnerability first disclosed.
2. 24-04-2026
   Added to CISA KEVD-Link DIR-823X Command Injection Vulnerability
3. 25-04-2026
   Last modifiedVulnerability information updated.
4. 08-05-2026
   CISA remediation dueApply mitigations per vendor instructions.

Description

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.