# CVE-2025-29635: DIR-823X - RCE

> Live exploitation tracking for CVE-2025-29635 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-29635

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.2
- **Public exploit available:** Yes
- **Affected products:** D-Link DIR-823X
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** iot

## Description

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

## CrowdSec analysis

[CVE-2025-29635](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-29635) is a high-severity command injection vulnerability in D-Link DIR-823X firmware versions 240126 and 240802. An authorized remote attacker can exploit the `/goform/set_prohibiting` endpoint through a crafted POST request to execute arbitrary commands, potentially leading to full compromise of the affected device and impacting its confidentiality, integrity, and availability.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-29635 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target D-Link DIR-823X devices by sending authenticated POST requests to `/goform/set_prohibiting`. The `macaddr` parameter is injected with shell metacharacters and a remote `wget` command to execute arbitrary commands and trigger an external callback.

## Timeline

- 2025-03-25: CVE Published. CVE-2025-29635 is published to NVD.
- 2026-04-24: CISA KEV. CVE-2025-29635 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-05-08: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-09-17: Rule Released. CrowdSec releases a rule to detect CVE-2025-29635 exploitation attempts against the CrowdSec Network.
- 2026-10-08: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-29635 for the first time.

## References

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-29635
- https://github.com/projectdiscovery/nuclei-templates/blob/db04474cafb5f0cf730e0d6c0c19893063f0db9b/http/cves/2025/CVE-2025-29635.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-29635) follows observed exploitation activity for CVE-2025-29635. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.