Full Report
A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet. [...]
Analysis Summary
# Vulnerability: Mirai Botnet Exploitation of D-Link DIR-823X Command Injection
## CVE Details
- **CVE ID:** CVE-2025-29635
- **CVSS Score:** 8.8 (High) - *Based on typical NVD metrics for RCE in this class.*
- **CWE:** CWE-77 (Improper Neutralization of Special Elements used in a Command)
## Affected Systems
- **Products:** D-Link DIR-823X series routers.
- **Versions:** Firmware versions 240126 and 24082.
- **Configurations:** High-risk if the remote administration portal is accessible over the WAN.
## Vulnerability Description
CVE-2025-29635 is a command-injection vulnerability located in the `/goform/set_prohibiting` endpoint. The flaw exists because the firmware does not properly sanitize user-supplied input before passing it to a system shell function. An attacker can send a crafted HTTP POST request to this endpoint to execute arbitrary system commands with the privileges of the web server.
## Exploitation
- **Status:** Exploited in the wild (Detected March 2026 by Akamai SIRT).
- **Complexity:** Low.
- **Attack Vector:** Network (Remote).
- **PoC Availability:** Previously available on GitHub (now retracted), but currently being leveraged by threat actors in active campaigns.
## Impact
- **Confidentiality:** High (Attacker can access device configuration and traffic).
- **Integrity:** High (Attacker can modify firmware, settings, and install malware).
- **Availability:** High (Device can be bricked or enlisted into DDoS botnets).
## Remediation
### Patches
- **No Official Patch:** The affected devices reached End-of-Life (EoL) in November 2024. D-Link historically does not provide security updates for EoL hardware.
### Workarounds
- **Device Replacement:** The primary recommendation is to replace EoL routers with modern, supported hardware.
- **Disable Remote Access:** Ensure the web management interface is NOT accessible from the internet (WAN-side).
- **Credential Rotation:** Change default administrator passwords to prevent automated brute-force secondary attacks.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of a shell script named `dlink.sh` in writable directories (e.g., `/tmp`).
- Deployment of Mirai-based malware variant known as "**tuxnokill**".
- Outbound traffic patterns consistent with DDoS activity (TCP SYN/ACK floods, UDP floods).
- **Detection Methods:** Monitor for HTTP POST requests directed at the `/goform/set_prohibiting` endpoint originating from external IP addresses.
## References
- **D-Link Security Announcement:** hxxps[://]supportannouncement[.]us[.]dlink[.]com/security/publication[.]aspx?name=SAP10469
- **Akamai Research:** hxxps[://]www[.]akamai[.]com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2025-29635