CVE-2025-29635

Think of your router like the office’s traffic control desk. This bug lets a person who already has the ability to act as an authorized user send a specially crafted request to the router, and trick it into running commands—like giving the attacker a remote “do anything” console. That can lead to control of the router itself, which can disrupt internet service and expose your business network.

This matters if you run a D-Link DIR-823X AX3000 router on firmware 240126 or 240802. The vulnerability requires an authorized attacker (so it’s not a simple “anyone can hit the router and get in” flaw), and it is triggered by a remote POST request to /goform/set_prohibiting. Treat it as a real risk if an attacker can reach the router interface that handles this function and has already obtained authorized access (for example, via compromised admin credentials or another compromise path).

This is RED because CISA has confirmed it as a known exploited vulnerability (KEV), meaning it’s considered actively relevant in the real world. With a CISA remediation due date of 2026-05-08, you should treat routers running 240126/240802 as needing immediate action to remove or mitigate the exposure.

1. Identify exposure

• On the DIR-823X AX3000, find the firmware version and confirm whether it is exactly 240126 or 240802.
• If you are not on those versions, this specific CVE may not apply to your current firmware (but still review other updates your vendor recommends).

2. Apply the vendor response for this CVE

• Follow D-Link’s mitigation instructions for CVE-2025-29635, specifically addressing behavior tied to the /goform/set_prohibiting function.
• KEV guidance also says to apply mitigations per vendor instructions or take the alternative action below if mitigations are unavailable.

3. If mitigations aren’t available for your version/device

• CISA KEV guidance for this issue states you should discontinue use of the product if mitigations are unavailable, and replace it with a device/version that is covered by fixes.

4. Reduce the “authorized attacker” path

• Immediately remove any remote administration exposure (for example, anything that allows admin access from the internet).
• Enforce strong admin credentials and ensure there are no shared/known passwords.
• If you have reason to suspect credentials are compromised, assume the attacker may already have authorized access and move to replacement/forced credential resets as part of incident response.

5. What to monitor

• Router admin activity and failed/successful login attempts.
• Unexpected configuration changes tied to prohibited/content-control features (the vulnerable endpoint name suggests this area).
• Any signs the router’s behavior changed after suspicious login activity (e.g., new admin users, altered settings, or unexpected connectivity disruptions).

6. Timeline

• CISA KEV remediation due date: 2026-05-08.

Severity and type: This is a command injection vulnerability (CWE-77) that can allow arbitrary command execution on the DIR-823X AX3000 device. Mechanism: an authorized attacker can send a crafted HTTP POST request to /goform/set_prohibiting, injecting input that results in execution of attacker-supplied commands. Preconditions: authentication is required (authorized attacker) and no user interaction is needed. Exploitation status: CISA listed this issue in the KEV program (added 2026-04-24) with a remediation due date of 2026-05-08, indicating it is expected to be used in real-world attacks. Exploit availability: no public exploit code was found in the provided findings. EPSS: a very high predicted likelihood is reported, but KEV is the higher-confidence signal for urgency.