CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability

Vereiste actie (tekst van CISA, Engels)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Beschrijving (NVD, Engels)

D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

BRONNEN

• CISA KEVCISA Known Exploited Vulnerabilities catalog

Andere lekken bij D-Link

• CVE-2022-37055: D-Link Routers Buffer Overflow Vulnerability
• CVE-2022-40799: D-Link DNR-322L Download of Code Without Integrity Check Vulnerability
• CVE-2020-25079: D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
• CVE-2020-25078: D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability
• CVE-2024-0769: D-Link DIR-859 Router Path Traversal Vulnerability

Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.