Live › vulnerability › CVE-2025-29635
Go to dashboardD-Link DIR-823X home routers have a command injection flaw in the /goform/set_prohibiting endpoint. An attacker with valid access can run arbitrary commands on the device, and CISA reports it is being exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| D-Link DIR-823X | vendor | – | – |
| dlink dir-823x firmware | vendor | = 240126 | – |
| dlink dir-823x firmware | vendor | = 240802 | – |
Check whether any D-Link DIR-823X router is in use on the network, including at remote or branch sites.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2025-29635")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.