CVE-2025-29635 D-Link DIR-823X Command Injection
An authorized attacker can execute arbitrary commands on D-Link DIR-823X routers via a POST request to the set_prohibiting endpoint.
- Exploited in the wild
- Since 24 Apr 2026
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-29635?
CVE-2025-29635 is a high-severity command injection vulnerability in n/a, published on 25 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
Weakness: CWE-77
Which versions are affected by CVE-2025-29635?
It affects 1 product.
Products include Dlink Dir-823x Firmware.
How do I fix CVE-2025-29635?
No fix has been published for CVE-2025-29635 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 8 May 2026.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-29635 being exploited?
Yes. Attackers have exploited CVE-2025-29635 in the wild since at least 24 Apr 2026.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-m9wc-3h85-pp63.