CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability

This vulnerability affects the D-Link DIR-823X router and allows an authorized attacker to execute arbitrary commands on the device. It is a command injection issue that can give an attacker control over a network device that often sits at the edge of home or small-office networks.

How it works

The weakness is categorized as CWE-77, command injection. An attacker who already possesses valid credentials or session access can send a crafted POST request to the endpoint /goform/set_prohibiting. The corresponding server-side function fails to neutralize special characters or shell metacharacters, so the supplied input is passed directly to an operating-system command interpreter. This results in execution of attacker-controlled commands on the router.

Am I affected? How to find it in your systems

Inventory all D-Link DIR-823X devices on your network. These routers are typically deployed as consumer or small-office gateways; scan for their MAC OUI ranges or use network-discovery tools to locate devices responding on common management ports. Check the firmware version and configuration against the vendor advisory, because the product may already be end-of-life or end-of-service. Review router logs for unexpected POST requests to /goform/set_prohibiting or for command-line activity that originates from the web-management process.

How to remediate

Apply the firmware or configuration update published by the vendor for this issue. If the advisory states that the product has reached end-of-life or end-of-service and no patch is available, discontinue use of the device. After patching, disable remote management interfaces that are not required and enforce strong, unique credentials for any remaining administrative access.

If you can't patch immediately

Place the router behind a separate firewall or network segment so that only trusted hosts can reach its management interface. If a web-application firewall or inline filter is available, block or sanitize requests that contain shell metacharacters directed at /goform/set_prohibiting. Monitor authentication logs and outbound traffic from the device for anomalies until the device can be replaced or updated.

If your data may have been exposed

Actively exploited command-injection flaws on network devices have led to unauthorized access and data exposure in past incidents. You can run a free exposure scan of your email addresses against known breach data to check for signs of prior compromise.