CVE-2025-29635: D-Link DIR-823X Command Injection, Active Mirai Exploitation (KEV)

CVE-2025-29635 is a command injection flaw in the /goform/set_prohibiting endpoint of D-Link DIR-823X router firmware that lets an attacker run arbitrary OS commands on the device, the router is already end-of-life with no patch coming, and Akamai has observed it actively exploited in the wild by a Mirai botnet variant since March 2026.

CVE-2025-29635 (CWE-77, improper neutralization of special elements used in a command) is a command injection vulnerability in D-Link DIR-823X router firmware versions 240126 and 240802. NVD's description states it "allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution" (NVD).

The only CVSS metric on record is a CVSS v3.1 score of 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, attributed to CISA's NVD-authorized data publisher (ADP) feed rather than to NVD's own analysts, and NVD has not published an independent Primary score. Because that figure is a Secondary (ADP) metric, this page leaves cvss_score unset instead of presenting 7.2 as NVD-confirmed. The PR:H (high privileges required) component of that vector should be read against the real-world exploitation pattern described below, which does not document a credential requirement for the observed attacks (NVD).

Akamai's security research team reports the root cause in technical detail: "the value of the macaddr function is copied into the command variable by the snprintf function, after which the system function is executed" — i.e., attacker-controlled input reaches a shell command unsanitized. Akamai's honeypot network first observed active exploitation in March 2026, a year after the CVE's initial March 2025 disclosure, delivering a Mirai botnet variant the researchers named "tuxnokill." The malware supports multiple CPU architectures, uses XOR-encoded strings, has hard-coded command-and-control infrastructure at 64.89.161[.]130:44300, and conducts standard DDoS attacks including TCP SYN floods, UDP DNS floods, and HTTP floods (Akamai, CVE-2025-29635: Mirai Campaign Targets D-Link Devices).

D-Link's own support advisory confirms the DIR-823X, across all hardware revisions, reached End of Life/End of Service as of 2024-11-15, states that D-Link "will be unable to resolve device or firmware issues since all development and customer support has ceased," and "strongly recommends that this product be retired." No patched firmware exists or is planned (D-Link Security Advisement, SAP10469).

CISA added CVE-2025-29635 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-24, with a required-action due date of 2026-05-08, and its KEV entry explicitly notes the affected product "could be end-of-life (EoL) and/or end-of-service (EoS)" and that "users should discontinue product utilization" (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.87944 (99.763th percentile), among the highest EPSS scores observed and consistent with ongoing botnet scanning (FIRST EPSS).

Because there is no fix and the device is formally end-of-life, any DIR-823X still in service should be retired and replaced rather than patched; if continued use is unavoidable in the short term, isolate it from the internet-facing interface, disable remote management, and monitor for the documented Mirai indicators of compromise.

• Command injection in D-Link DIR-823X firmware 240126 and 240802: attacker sends a crafted POST request to /goform/set_prohibiting to execute arbitrary commands. — NVD
• The only CVSS metric (3.1, 7.2, vector including PR:H) is a CISA-ADP Secondary score; NVD has not published its own Primary score. — NVD
• Root cause: unsanitized macaddr value copied via snprintf into a command string executed by system(); actively exploited since March 2026 by a Mirai variant ('tuxnokill') with hard-coded C2 at 64.89.161.130:44300, conducting SYN/UDP/HTTP flood DDoS. — Akamai, CVE-2025-29635: Mirai Campaign Targets D-Link Devices
• DIR-823X (all hardware revisions) reached End of Life/End of Service on 2024-11-15; D-Link will not resolve device or firmware issues and recommends retiring the product. — D-Link Security Advisement, SAP10469
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-04-24, required-action due date 2026-05-08; KEV entry flags the product as possibly EoL/EoS and recommends discontinuing use. — CISA KEV
• EPSS score is 0.87944 (99.763th percentile) as of 2026-10-29. — FIRST EPSS