CVE-2025-29635 — Mirai Variant Campaign Recruiting D-Link DIR-823X Routers via /goform/set_prohibiting Command Injection

CVE-2025-29635 (TL-2026-0406), also tracked as DIR-823X Mirai Recruitment Campaign, is a high-severity malware campaign scored CVSS 8.8, first published 2026-04-21. It is attributed to Mirai Botnet Operator with low confidence, affects D-Link DIR-823X, references 4 CVEs (CVE-2025-29635, CVE-2026-2129, CVE-2026-2142), maps to 25 MITRE ATT&CK techniques (T1036, T1046, T1057), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-0406

Threat ID
TL-2026-0406
Also known as
DIR-823X Mirai Recruitment Campaign, Mirai DIR-823X /goform/ cluster, set_prohibiting RCE
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
MALWARE
First published
2026-04-21
Last reviewed
2026-04-21
Attribution
Mirai Botnet Operator
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
telecommunications, residential isp, small business, education, hospitality, retail
Target regions
Asia-Pacific, Latin America, Europe, North America, Africa
Detection rules
9
Indicators of compromise
23

Malware and tooling in CVE-2025-29635

Malware and tooling: Mirai, Mirai

A new Mirai-variant botnet is actively recruiting D-Link DIR-823X SOHO routers by chaining CVE-2025-29635 — an authenticated OS command injection in the /goform/set_prohibiting endpoint (firmware 240126 and 240802) — with default and weak credential reuse. Compromised devices are flashed with MIPS/ARM Mirai payloads and enlisted into DDoS staging fleets. An adjacent cluster of command-injection CVEs (CVE-2026-2129 set_ac_status, CVE-2026-2142 set_qos, CVE-2026-2143 set_ddns) on DIR-823X firmware 250416 indicates an expanding /goform/ attack surface against the same device family.

How CVE-2025-29635 works

Threadlinqs Intelligence is tracking a Mirai-variant botnet campaign (observed by Akamai SIRT in April 2026) that is actively recruiting D-Link DIR-823X SOHO routers at scale. The primary exploitation primitive is CVE-2025-29635, an OS command injection in the router's web-administration binary reachable through HTTP POST requests to /goform/set_prohibiting. The affected function consumes user-controlled parameters from the POST body and passes them into a system()/popen() sink without sanitization, allowing arbitrary shell metacharacters (;, &&, |, backticks, $(...)) to break out of the intended argument context and execute attacker commands in the router's BusyBox shell as root.

Although NVD scores the issue PR:L (requires authentication), Mirai operators routinely bypass this pre-condition in three ways: (1) reuse of leaked / factory-default credentials (admin/admin, admin/password, blank), (2) brute-force of the administrative interface over HTTP(S) on exposed WAN management, and (3) chaining with adjacent unauthenticated information-disclosure or session-handling weaknesses on the same device. Once authenticated, the injected command typically wgets a small downloader (e.g. /tmp/dlr) which then chain-loads architecture-specific Mirai binaries (mips, mipsel, arm5/6/7, x86) from an attacker-controlled HTTP server.

The recruited implants fork, rename their process to mimic legitimate daemons (dropbear, telnetd, [kworker]), open a raw socket for SYN/GRE/UDP DDoS attack vectors, and establish a long-lived TCP session to a hardcoded or DGA-derived C2 on ports 1312 / 23 / 666 / 8080. Killer routines attempt to remove competing botnets (Qbot, Gafgyt, Hajime, Mozi) and to disable firmware update services. Persistence is weak — Mirai classically lives in /tmp and volatile RAM — so the botnet relies on continuous reinfection via the same exploit chain to maintain fleet size across router reboots.

The DIR-823X /goform/ endpoint family is showing sustained researcher and attacker interest. Within a two-month window in early 2026, VulDB/master-abc disclosed three additional command-injection issues on firmware 250416: CVE-2026-2129 (set_ac_status, parameters ac_ipaddr / ac_ipstatus / ap_randtime), CVE-2026-2142 (set_qos, function sub_420688), and CVE-2026-2143 (set_ddns, DDNS-Service parameters ddnsType / ddnsDomainName / ddnsUserName / ddnsPwd). All share the same root cause class (CWE-77 / CWE-78), the same privilege precondition (PR:H), and all have public PoC exploits. Defenders should treat the DIR-823X web-admin surface as fully compromised and assume any exposed device is recruitable.

D-Link has not shipped a patched firmware for the DIR-823X as of the reporting window; the device is EoL / end-of-service in several regions. Defenders should treat exposed DIR-823X devices as unfixable and remove them from the edge — particularly any with WAN-side HTTP management enabled.

MITRE ATT&CK techniques used in TL-2026-0406

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal

Discovery

T1046 Network Service Discovery; T1057 Process Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1110 Brute Force; T1555 Credentials from Password Stores

Lateral Movement

T1210 Exploitation of Remote Services

defense-impairment

T1222 File and Directory Permissions Modification

Impact

T1496 Resource Hijacking; T1498 Network Denial of Service; T1499 Endpoint Denial of Service

Persistence

T1543 Create or Modify System Process

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CVE-2025-29635

  • D-Link — DIR-823X
    Vulnerable versions: firmware 240126; firmware 240802; firmware 250416

Remediation for CVE-2025-29635

Patches

  • No official D-Link patch is available for the DIR-823X as of 2026-04-21 — device is EoL in most regions
  • If a firmware update is later published for firmware >240802 or >250416, apply immediately after validating against vendor advisory

Immediate actions

  • Disable WAN-side HTTP/HTTPS management on all DIR-823X routers immediately
  • Change the router admin password from any factory default to a long unique credential
  • Block inbound TCP to /goform/ paths at upstream firewall/ISP CPE if management is required
  • Identify DIR-823X devices on Shodan/Censys-indexed WAN space owned by the organization and remove them from the edge
  • Monitor NetFlow/DNS for outbound connections to Mirai-typical C2 ports (1312, 666, 23, 48101, 8080) from router-range IPs

Workarounds

  • Place the DIR-823X behind an upstream firewall that blocks all inbound HTTP/HTTPS to the router's WAN IP
  • Disable Remote Management / Remote Admin Access toggle in the router web UI
  • Restrict LAN access to the web-admin interface to a single hardened management host via ACL
  • Replace the device — this is the supported mitigation

Longer-term hardening

  • Retire EoL SOHO routers (DIR-823X is no longer supported) and replace with supported hardware
  • Segment IoT/SOHO routers into a dedicated VLAN with egress filtering to known-good destinations only
  • Deploy a network sensor (Zeek/Suricata) at the Internet edge with Mirai-family detection rules and /goform/ command-injection signatures
  • Enforce credential-rotation policy for all management planes on network-edge devices
  • Subscribe to D-Link PSIRT and CISA KEV feeds for SOHO-router advisories

CVEs associated with CVE-2025-29635

CVE-2025-29635, CVE-2026-2129, CVE-2026-2142, CVE-2026-2143

Weaknesses (CWE) in CVE-2025-29635

CWE-77, CWE-78

Timeline of CVE-2025-29635

  • D-Link DIR-823X firmware 240126 released — later confirmed vulnerable to CVE-2025-29635 in /goform/set_prohibiting.
  • D-Link DIR-823X firmware 240802 released — still contains the unsanitized set_prohibiting handler.
  • Researcher mono7s publishes a public PoC for the /goform/set_prohibiting command injection on GitHub, which is later referenced by NVD and INCIBE-CERT.
  • NVD publishes CVE-2025-29635 with CVSS 8.8 HIGH and CWE-77 classification; vulnerability status moves to Analyzed on 2025-04-03.
  • D-Link DIR-823X firmware 250416 released without remediation for the /goform/ command-injection class; subsequent research discloses three additional issues on this build.
  • VulDB publishes CVE-2026-2129 (set_ac_status), CVE-2026-2142 (set_qos), and CVE-2026-2143 (set_ddns) — all OS command injection on DIR-823X firmware 250416 with public PoCs credited to researcher master-abc.
  • RedPacketSecurity issues a CVE alert amplifying awareness of the DIR-823X /goform/ cluster, driving broader defender attention to the attack surface.
  • Akamai SIRT reports a new Mirai variant actively recruiting DIR-823X devices via CVE-2025-29635; Threadlinqs Intelligence opens tracking as TL-2026-0406.
  • As of 2026-05-29, this remains an active threat: Akamai SIRT confirmed in-the-wild Mirai ("tuxnokill") exploitation of CVE-2025-29635 on D-Link DIR-823X routers in March/April 2026, and CISA added it to KEV on 2026-04-24 with a 2026-05-08 federal deadline. The device is EoL with no patch available or expected, so exposed routers stay recruitable.

Sources cited for CVE-2025-29635

Threats related to CVE-2025-29635

Detection coverage for TL-2026-0406

As of 2026-04-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0406 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats