CVE-2025-29635: D-Link DIR-823X authenticated command injection on an end-of-life router
Tech GuruQuick Answer
CVE-2025-29635 is authenticated command injection in the D-Link DIR-823X. D-Link's SAP10469 covers all hardware revisions and lists support ending November 15, 2024; its recommendation is retirement and replacement, not waiting for another firmware fix. Preserve configuration and security evidence, plan the replacement and review suspicious administrative access. A support-page Resolved label does not prove that vulnerable routers received a patch.
Fix Or Immediate Action
What to do now: D-Link identifies the affected model as end of life/end of service; retire and replace it rather than relying on continued exposure.
Evidence check: Vendor evidence and unresolved source limits are described below. CISA KEV catalog 2026.10.02 was checked on October 2. Preserve the distinction between vendor publication history, catalog dates and evidence from your deployment; no patch or exploit test is claimed.
Context
Scope And Impact In Plain Language
Who should check: Anyone who manages D-Link DIR-823X.
When this applies: Only when the exact product, version, and required configuration match the live vendor advisory. Owning the product family alone does not mean the device is vulnerable.
What could happen: A successful attacker may be able to run attacker-chosen commands or software on the affected system, subject to the access and configuration requirements in the advisory.
Not sure? Find the product name and version in the device or application, then compare them with the affected-products section of the linked vendor notice.
Status At A Glance
| Product scope | D-Link — DIR-823X |
|---|---|
| CVE | CVE-2025-29635 |
| TechGeeks response tier | P0 — confirm an exact match and act now |
| CISA KEV added | 2026-04-24 |
| Vendor severity | Consult the live vendor advisory; no vendor severity is inferred from KEV status. |
| CVSS | Consult the live vendor advisory; no CVSS value is inferred from KEV status. |
| Ransomware field | Unknown — this is not the same as No; CISA has not marked the field Known. |
| Forensic-triage field | No in the current CISA field; organizations should still investigate when exposure or evidence warrants it. |
| CWE | CWE-77 |
| Federal remediation date | 2026-05-08 — applies to covered federal agencies; other organizations should set a risk-based deadline. |
What Happened
D-Link DIR-823X Command Injection Vulnerability. D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA's KEV listing confirms exploitation evidence, but it does not state how widespread the activity is or prove that any particular installation was compromised.
Affected Scope
D-Link's retirement notice applies to all DIR-823X hardware revisions and firmware versions. Record the exact model and administrative exposure, but do not use an installed firmware number to override the vendor's end-of-service decision.
Match the exact edition, hardware or virtual platform, release, patch level, enabled feature, and management exposure. A product-family name alone is not enough to establish applicability.
Steps
What To Do Now
- Confirm. Inventory every DIR-823X asset and record its exact version, patch level, role, relevant configuration, and exposure.
- Preserve. Save UTC timestamps, off-device authentication, firewall, proxy, DNS, endpoint, application, and SIEM evidence before logs rotate or a disruptive change removes context.
- Contain. Restrict unnecessary internet and management-plane access using supported controls. Follow the live advisory: Open the live D-Link advisory.
- Remediate. D-Link identifies the affected model as end of life/end of service; retire and replace it rather than relying on continued exposure.
- Validate. Confirm the old DIR-823X is no longer serving or exposing management access, and verify the replacement's connectivity, intended access restrictions, logging and supported firmware. Record configuration changes and recovery evidence; migration success is not incident eradication evidence.
- Escalate. If exposure overlapped the vulnerable period or evidence is suspicious, treat the system as a potential incident and follow vendor and incident-response recovery guidance.
Fixed Releases And Mitigation
Permanent Fix
SAP10469 directs retirement and replacement of the DIR-823X and says firmware development ends with its support lifecycle. No fixed firmware is established here; the page's Resolved status must not be read as a patch release. Plan a supported replacement, validate required network services and remove the old router from service.
Workaround Or Temporary Mitigation
Discontinue use and replace the affected end-of-life product, following D-Link SAP10469.
Important boundary: A workaround, access restriction, or provider-side control may reduce risk while the update is prepared, but it does not necessarily remove vulnerable code or erase an earlier compromise. Install the vendor-approved update when one is available.
Investigation And Recovery
CISA's KEV record does not mark this entry for forensic triage. That field is not proof of a clean system; consult the vendor advisory for indicators and recovery guidance.
When an attacker may have gained administrative, root, SYSTEM, identity, management-plane, or code-execution access, patching alone is not an eradication claim. Preserve evidence, scope affected accounts and downstream systems, rotate exposed credentials or certificates when justified, and rebuild from a trusted source when vendor or incident-response guidance requires it.
Notes
Exploitation Evidence
Vendor statement: D-Link's lifecycle notice does not supply a CVE-specific exploitation assessment. CISA separately records exploitation and an April 24, 2026 KEV addition; neither the lifecycle status nor a successful replacement proves the old router was uncompromised.
CISA statement: CVE-2025-29635 was added to KEV on 2026-04-24. The ransomware field is Unknown, and the forensic-triage field is No. These are separate signals.
Validation And Boundaries
This notice does not prove that every product carrying the family name is affected, that exploitation is widespread, that a clean indicator search rules out compromise, or that a successful update restored trust. TechGeeks has not reproduced the exploit and does not replace the vendor advisory, asset inventory, vulnerability scanner, or incident-response process.
Related TechGeeks Resources
- TechGeeks Security Notice Center
- All Security Notices
- What to Do When a Device Hits CISA KEV
- Router CVE Exposure, Version, and Mitigation Checklist
- IoT Firmware Update and End-of-Support Checklist
- Live Protect and Runtime Vulnerability Shielding
References
Wrap-Up
Record whether CVE-2025-29635 applies to your environment. If it does, assign an owner, preserve the change and investigation evidence, complete the vendor action, and document the validated result.
Correction policy: If a primary source changes affected versions, remediation, exploitation status, or recovery guidance, TechGeeks will update this page and its verification date.
