CVE-2025-29635 — Mirai Variant Campaign Recruiting D-Link DIR-823X Routers via /goform/set_prohibiting Command Injection — Threadlinqs Intelligence
As of 2026-05-30, CVE-2025-29635 — Mirai Variant Campaign Recruiting D-Link DIR-823X Routers via /goform/set_prohibiting Command Injection is a high-severity malware threat attributed to Mirai Botnet Operator (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-0406 · Severity: HIGH · CVSS: 8.8 · Status: ACTIVE · Category: MALWARE
Attribution: Mirai Botnet Operator · N/A · FINANCIAL
A new Mirai-variant botnet is actively recruiting D-Link DIR-823X SOHO routers by chaining CVE-2025-29635 — an authenticated OS command injection in the /goform/set_prohibiting endpoint (firmware
Threadlinqs Intelligence is tracking a Mirai-variant botnet campaign (observed by Akamai SIRT in April 2026) that is actively recruiting D-Link DIR-823X SOHO routers at scale. The primary exploitation primitive is CVE-2025-29635, an OS command injection in the router's web-administration binary reachable through HTTP POST requests to /goform/set_prohibiting. The affected function consumes user-controlled parameters from the POST body and passes them into a system()/popen() sink without sanitization, allowing arbitrary shell metacharacters (;, &&, |, backticks, $(...)) to break out of the intended argument context and execute attacker commands in the router's BusyBox shell as root.
Although NVD scores the issue PR:L (requires authentication), Mirai operators routinely bypass this pre-condition in three ways: (1) reuse of leaked / factory-default credentials (admin/admin, admin/password, blank), (2) brute-force of the administrative interface over HTTP(S) on exposed WAN management, and (3) chaining with adjacent unauthenticated information-disclosure or session-handling weaknesses on the same device. Once authenticated, the injected command typically wgets a small downloader (e.g. /tmp/dlr) which then chain-loads architecture-specific Mirai binaries (mips, mipsel, arm5/6/7, x86) from an attacker-controlled HTTP server.
The recruited implants fork, rename their process to mimic legitimate daemons (dropbear, telnetd, [kworker]), open a raw socket for SYN/GRE/UDP DDoS attack vectors, and establish a long-lived TCP session to a hardcoded or DGA-derived C2 on ports 1312 / 23 / 666 / 8080. Killer routines attempt to remove competing botnets (Qbot, Gafgyt, Hajime, Mozi) and to disable firmware update services. Persistence is weak — Mirai classically lives in /tmp and volatile RAM — so the botnet relies on continuous reinfection via the same exploit chain to maintain fleet size across router reboots.
The DIR-823X /goform/ endpoint family is showing sustained researcher and attacker interest. Within a two-month window in early 2026, VulDB/master-abc disclosed three additional command-injection issues on firmware 250416: CVE-2026-2129 (set_ac_status, parameters ac_ipaddr / ac_ipstatus / ap_randtime), CVE-2026-2142 (set_qos, function sub_420688), and CVE-2026-2143 (set_ddns, DDNS-Service parameters ddnsType / ddnsDomainName / ddnsUserName / ddnsPwd). All share the same root cause class (CWE-77 / CWE-78), the same privilege precondition (PR:H), and all have public PoC exploits. Defenders should treat the DIR-823X web-admin surface as fully compromised and assume any exposed device is recruitable.
D-Link has not shipped a patched firmware for the DIR-823X as of the reporting window; the device is EoL / end-of-service in several regions. Defenders should treat exposed DIR-823X devices as unfixable and remove them from the edge — particularly any with WAN-side HTTP management enabled.
Weaknesses (CWE)
CWE-77, CWE-78
Target sectors: telecommunications, residential isp, small business, education, hospitality, retail
Target regions: Asia-Pacific, Latin America, Europe, North America, Africa
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2025-29635, CVE-2026-2129, CVE-2026-2142, CVE-2026-2143, T1595, T1592, T1583, T1608, T1587, T1190, T1078, T1059, T1203, T1543