D-Link DIR-823X end-of-life router: command injection flaw CVE-2025-29635 used by Mirai botnet, no fix
The D-Link DIR-823X router has a command injection flaw (CVE-2025-29635) that a Mirai botnet has used since March 2026. The router is end of life and will get no fix. If you own one, replace it with a supported router.
If you have a D-Link DIR-823X, replace it with a router that still gets security updates, then change the passwords of anything you logged into through it. If you can't replace it straight away, make sure its web admin page isn't reachable from the internet.
- D-Link DIR-823Xno fixed version yet
What’s happening
CVE-2025-29635 is a command injection flaw in the web management interface of the D-Link DIR-823X home router. Akamai's research team reported on 21 April 2026 that a Mirai botnet variant has been exploiting it since early March 2026, sending crafted requests to the router to run commands and install malware that can be used for denial-of-service attacks. Akamai listed firmware versions 240126 and 24082 as affected. The CVE record describes the attacker as authorised, but Akamai saw attack requests with no login tokens and suspects valid credentials may not be needed. CISA added the flaw to its list of flaws being used in attacks on 24 April 2026. D-Link's notice says the DIR-823X is end of life in all hardware revisions and firmware versions, that it will not develop firmware for such products, and that owners should retire and replace them. There is no fix and none is expected. Sources differ on the end-of-life date (D-Link lists end of support as 15 November 2024; Akamai says the series was retired in September 2025). The same attacker was also seen targeting a TP-Link and a ZTE router.
- What
- Flaw
- Affects
- D-Link DIR-823X home router (all hardware revisions and firmware)
- Affected
- D-Link DIR-823X, all hardware revisions and all firmware versions (D-Link)
Firmware 240126 and 24082 named as exploited (Akamai) - Fixed in
- No fix yet
- Since
- 21 Apr 2026
- Closed
- 24 Apr 2026
Timeline
- CISA addedNo fix yet
CISA added CVE-2025-29635 to its list of flaws being used in attacks, advising users to stop using the end-of-life product.
- Vendor revisedNo fix yet
D-Link updated its DIR-823X end-of-life notice. It still lists no fix and says the maker will not develop firmware for end-of-life products.
- Wider attacksNo fix yet
Akamai's research team reported that a Mirai botnet variant had been exploiting the flaw since early March 2026, against firmware versions 240126 and 24082. The requests it saw carried no login tokens, so exploitation may not need valid credentials.
- Vendor revisedNo fix yet
D-Link US published notice SAP10469 listing the DIR-823X (all hardware revisions and firmware) as end of life, with no new firmware planned and a recommendation to retire and replace the device.
- Made public
CVE-2025-29635, a command injection flaw in the D-Link DIR-823X router, was publicly disclosed (late March 2025, per Akamai).
Sources
- D-Link DIR-823X end-of-life notice SAP10469D-Link · 23 Apr 2026
- CVE-2025-29635: Mirai Campaign Targets D-Link DevicesAkamai · 21 Apr 2026
- New Mirai campaign exploits RCE flaw in EOL D-Link routersAviatrix · 22 Apr 2026