{"id":"dlink-dir-823x-mirai-command-injection-apr-2026","category":"patch","status":"closed","title":"D-Link DIR-823X end-of-life router: command injection flaw CVE-2025-29635 used by Mirai botnet, no fix","tldr":"The D-Link DIR-823X router has a command injection flaw (CVE-2025-29635) that a Mirai botnet has used since March 2026. The router is end of life and will get no fix. If you own one, replace it with a supported router.","summary":"CVE-2025-29635 is a command injection flaw in the web management interface of the D-Link DIR-823X home router. Akamai's research team reported on 21 April 2026 that a Mirai botnet variant has been exploiting it since early March 2026, sending crafted requests to the router to run commands and install malware that can be used for denial-of-service attacks. Akamai listed firmware versions 240126 and 24082 as affected. The CVE record describes the attacker as authorised, but Akamai saw attack requests with no login tokens and suspects valid credentials may not be needed. CISA added the flaw to its list of flaws being used in attacks on 24 April 2026. D-Link's notice says the DIR-823X is end of life in all hardware revisions and firmware versions, that it will not develop firmware for such products, and that owners should retire and replace them. There is no fix and none is expected. Sources differ on the end-of-life date (D-Link lists end of support as 15 November 2024; Akamai says the series was retired in September 2025). The same attacker was also seen targeting a TP-Link and a ZTE router.","action":"If you have a D-Link DIR-823X, replace it with a router that still gets security updates, then change the passwords of anything you logged into through it. If you can't replace it straight away, make sure its web admin page isn't reachable from the internet.","product":"D-Link DIR-823X home router (all hardware revisions and firmware)","audience":"home","severity":"high","patch":"none","exploited":true,"cves":["CVE-2025-29635"],"tags":["d-link","dir-823x","router","end-of-life","mirai","botnet","command-injection","cisa-kev"],"affected":["D-Link DIR-823X, all hardware revisions and all firmware versions (D-Link)","Firmware 240126 and 24082 named as exploited (Akamai)"],"fixed":[],"matches":[{"platform":"router","app":"D-Link DIR-823X","bundle":"","fixed":""}],"sources":[{"kind":"advisory","title":"D-Link DIR-823X end-of-life notice SAP10469","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10469","by":"D-Link","date":"2026-04-23"},{"kind":"research","title":"CVE-2025-29635: Mirai Campaign Targets D-Link Devices","url":"https://www.akamai.com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices","by":"Akamai","date":"2026-04-21"},{"kind":"research","title":"New Mirai campaign exploits RCE flaw in EOL D-Link routers","url":"https://aviatrix.ai/threat-research-center/new-mirai-campaign-exploits-rce-flaw-in-eol-d-link-routers-cve-2025-29635","by":"Aviatrix","date":"2026-04-22"}],"started":"2026-04-21","closed":"2026-04-24","created":"2026-11-03T21:45:15.027Z","updated":"2026-11-03T21:45:15.027Z","cve_notes":[{"cve":"CVE-2025-29635","name":"Command injection in D-Link DIR-823X router","what":"A command injection flaw in the DIR-823X's web management interface (the /goform/set_prohibiting request) that lets an attacker run their own commands on the router; a Mirai botnet is using it to take over devices.","severity":"high","cvss":7.2}],"timeline":[{"at":"2026-04-24","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA added CVE-2025-29635 to its list of flaws being used in attacks, advising users to stop using the end-of-life product.","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10469","by":"CISA","patch":"none"},{"at":"2026-04-23","added":"2026-11-03T21:41:32.717Z","kind":"vendor-revised","text":"D-Link updated its DIR-823X end-of-life notice. It still lists no fix and says the maker will not develop firmware for end-of-life products.","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10469","by":"D-Link","patch":"none"},{"at":"2026-04-21","added":"2026-11-03T21:41:32.717Z","kind":"wider-attacks","text":"Akamai's research team reported that a Mirai botnet variant had been exploiting the flaw since early March 2026, against firmware versions 240126 and 24082. The requests it saw carried no login tokens, so exploitation may not need valid credentials.","url":"https://www.akamai.com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices","by":"Akamai","patch":"none"},{"at":"2025-09-29","added":"2026-11-03T21:41:32.717Z","kind":"vendor-revised","text":"D-Link US published notice SAP10469 listing the DIR-823X (all hardware revisions and firmware) as end of life, with no new firmware planned and a recommendation to retire and replace the device.","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10469","by":"D-Link","patch":"none"},{"at":"2025-03-31","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"CVE-2025-29635, a command injection flaw in the D-Link DIR-823X router, was publicly disclosed (late March 2025, per Akamai).","url":"https://www.akamai.com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices","by":"Akamai","patch":null}],"url":"https://hard.fyi/live/dlink-dir-823x-mirai-command-injection-apr-2026/","json":"https://hard.fyi/api/live?id=dlink-dir-823x-mirai-command-injection-apr-2026"}