CVE-2025-29635 D-Link DIR-823X: command or code injection
In plain words: The program treats text it receives as instructions instead of plain data. The attacker can run commands on the machine — often the whole device is taken over.
Confirmed exploited by CISA on · US federal patch deadline May 8, 2026
What to do
- Install D-Link's security update for DIR-823X. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Turn on automatic firmware updates and replace gear the maker no longer supports.
- Change default passwords and switch off remote administration and features you do not use.
- Do not put storage boxes or cameras directly on the internet — use the maker's app or a VPN.
Who is affected
Could reach you. This one is aimed at devices or apps of the kind people own.
What's at risk: Taken over in bulk to join botnets, used to watch your traffic, or — for storage boxes — locked by ransomware.
The details
- Official name
- D-Link DIR-823X Command Injection Vulnerability
- Product
- D-Link DIR-823X
- CISA description
- D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Type of flaw
- Command or code injection (CWE-77)
- Confirmed exploited
- Apr 24, 2026
- US federal patch deadline
- May 8, 2026
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2025-29635 ·
Questions about CVE-2025-29635
Is CVE-2025-29635 being exploited?
Yes. CISA added CVE-2025-29635 to its Known Exploited Vulnerabilities catalog on Apr 24, 2026, which means there is reliable evidence of real-world attacks.
How do I fix CVE-2025-29635?
Install D-Link's security update for DIR-823X. If no update exists, follow the vendor's workaround or stop using the product until one ships. Turn on automatic firmware updates and replace gear the maker no longer supports.
Am I affected by CVE-2025-29635?
Only if you use D-Link DIR-823X. This one is aimed at devices or apps of the kind people own.