The CVE-2025-29635 vulnerability in D-Link DIR-823X routers (firmware versions 240126 and 240802) allows authenticated attackers to execute arbitrary commands remotely via a crafted POST request to /goform/set_prohibiting. The flaw arises due to insufficient input validation in the web management interface, enabling command injection through user-supplied parameters. Attackers can exploit this by sending malicious payloads embedded in HTTP requests, leading to full system compromise.
DailyCVE Form
Platform: D-Link DIR-823X
Version: 240126, 240802
Vulnerability: Command Injection
Severity: Critical
Date: 04/03/2025
What Undercode Say:
Exploitation:
1. Craft a malicious POST request:
curl -X POST -d "parameter=;$(malicious_command)" http://target/goform/set_prohibiting
2. Use Metasploit module (if available):
use exploit/linux/http/dlink_dir823x_rce set RHOSTS <target_IP> exploit
Detection:
1. Check logs for suspicious POST requests:
grep "POST /goform/set_prohibiting" /var/log/httpd.log
2. Scan with Nmap NSE script (if developed):
nmap --script dlink-cve-2025-29635 <target_IP>
Mitigation:
1. Apply vendor firmware patches immediately.
2. Restrict web interface access via firewall:
iptables -A INPUT -p tcp --dport 80 -s trusted_IP -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j DROP
3. Disable remote admin if unused:
uci set uhttpd.main.listen_http=0.0.0.0:80 && uci commit
Analysis:
- CVSS 4.0: 9.8 (Critical)
- Impact: Remote code execution as root.
- Exploitability: Low complexity, no privileges required.
References:
References:
Reported By: https://nvd.nist.gov/vuln/detail/CVE-2025-29635
Extra Source Hub:
Undercode
