CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability

criticalknown exploitedpublic exploitCVE-2025-29635
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

CSIRTS triage

vendor: D-Linkproduct: DIR-823XCode injection
What
The vulnerability allows an authorized attacker to execute arbitrary commands on remote devices via command injection.
Who is affected
Users of D-Link DIR-823X are affected, especially if the product is end-of-life or end-of-service.
Urgency
Remediation is urgent due to the critical severity and exploitation status.
Action
Discontinue product utilization or apply any available mitigations.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch DIR-823X

Get an email when a new DIR-823X advisory drops — max one per day, one-click unsubscribe.

Details

Source
CISA Known Exploited Vulnerabilities (US · database · site)
Severity
critical
Published
2026-04-24
Exploitation
Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-29635

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2025-29635coverage & exploitation statusNVD · CVE.org

More from CISA Known Exploited Vulnerabilities