DIR-823X - RCE (CVE-2025-29635)
Description
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
psychologyCrowdSec Analysis
CVE-2025-29635 is a high-severity command injection vulnerability in D-Link DIR-823X firmware versions 240126 and 240802. An authorized remote attacker can exploit the /goform/set_prohibiting endpoint through a crafted POST request to execute arbitrary commands, potentially leading to full compromise of the affected device and impacting its confidentiality, integrity, and availability.
CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-29635 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target D-Link DIR-823X devices by sending authenticated POST requests to /goform/set_prohibiting. The macaddr parameter is injected with shell metacharacters and a remote wget command to execute arbitrary commands and trigger an external callback.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-03-25 |
| CISA KEV | 2026-04-24 |
| CISA Remediation Deadline | 2026-05-08 |
| Rule Released | 2026-09-17 |
| CrowdSec First Seen | 2026-10-08 |