CVE Exploit Alert: CVE-2025-29635 | HIGH | CVSS 7.2 | D-Link DIR-823X

HIGH

Alert Date: 2026-05-02

Severity Overview

Summary

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

What the Attack Looks Like

How it works: Attacker-controlled data is embedded in a command passed to a shell or interpreter without sufficient escaping, causing unintended commands to execute alongside the intended one.

If successfully exploited: Full confidentiality and integrity impact means an attacker can both read and modify sensitive data — useful for credential harvesting, data theft, or manipulating application state. High availability impact means the vulnerability can also cause a denial of service, which may be used for disruption or as a diversion during a broader attack.

Analyst Takeaway

The attack is launched over the network (remotely exploitable without physical access) and high-privileged (administrative) credentials are required — the attacker must already control an admin account. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

Detection Guidance

• CWE-77 — Command Injection
  • Input log inspection: Search application logs and WAF telemetry for shell metacharacters in user-controlled fields: semicolons (;), pipes (|), ampersands (&), backticks, $(, %0a (newline), and their URL-encoded equivalents.
  • Process telemetry: Hunt for shell processes (bash, sh, cmd.exe, PowerShell) spawned as children of the web or application process. A web server that spawns a shell is a near-certain exploitation indicator.
  • Command execution artifacts: Look for evidence of commands running that the application would never normally execute — network tools (curl, wget, nc, ncat), file modification outside the app directory, or user account creation.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running D-Link DIR-823X. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Validate internet-facing exposure: Determine which of the affected systems are reachable from the public internet. Prioritize these for immediate remediation or compensating controls.

Remediation

• Apply the vendor patch: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• CISA directive deadline: 2026-05-08 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.

Detection Coverage

• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Vulnerability Details

Additional Notes

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10469 ; https://nvd.nist.gov/vuln/detail/CVE-2025-29635