← Back
CVE-2025-29635
CISA KEV
high
[KEV] Command Injection in D-link dir-823x (CVE-2025-29635)
Summary
command injection in D-link dir-823x (CVE-2025-29635). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
AI summary openai / gpt-4o
The D-Link DIR-823X router has a serious vulnerability. Exploiting this could enable an authenticated attacker to take control of the router or manipulate the network. There have been past incidents where similar vulnerabilities caused widespread network damage. It is recommended to discontinue using the product as it may not receive future updates.
The D-Link DIR-823X vulnerability CVE-2025-29635 involves a command injection issue where an authenticated attacker can execute arbitrary commands via POST requests to the "/goform/set_prohibiting" endpoint. This could result in system control being hijacked, leading to potential data leakage or service disruption within the network. Particular attention is needed if the router is EoL or EoS, and discontinuing its use is recommended. In absence of workarounds or patches, consider isolating the device from critical networks.
❓ What is the problem
D-Link DIR-823X routers have a command injection vulnerability.
📍 Affected scope
POST requests to '/goform/set_prohibiting'
🔥 Severity
High severity due to potential full system control by authenticated attackers.
🔧 How to fix
No patches specified; recommended to discontinue use if EoL/EoS.
🛡️ Workaround
Material not provided any workaround specifics.
🔍 Detection
Material does not specify detection methods, custom monitoring recommended.
Related past incidents Similar incidents extracted from past CVEs
A command injection vulnerability in D-Link routers allowing unauthorized command execution.
A previously existed command injection vulnerability in similar network products.
Utilized command injection vulnerabilities in routers for large-scale DDoS attacks.
If this happens at your company Expected impact per business scenario
📌 On a corporate network with sensitive data transfers
Attackers could intercept or reroute data, causing data leaks or loss of service.
📌 In a home automation setup controlled via a compromised router
Home devices could be controlled by unauthorized users, leading to privacy breaches or device malfunction.
📌 At an ISP level with multiple customers using the device
A single breach could lead to widespread service disruption or spying across affected networks.
Recommended action
Immediately assess if the router is EoL or EoS and cease its use if applicable. Consider upgrading to newer, supported models.
Response Actions (7 steps)
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'dir-823x' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で `dir-823x` を grep し、稼働しているサービス・バージョンを把握する。
-
4Consider incident declaration escalate
Notify SOC / on-callCISA KEV登録済 = 実環境で悪用が観測されている。Step 3 で兆候があればインシデント対応宣言、無くてもパッチ適用までWAF強化を最優先で。
-
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。
References
- advisory NVD