# CVE-2025-29635 — Mirai Variant Campaign Recruiting D-Link DIR-823X Routers via /goform/set_prohibiting Command Injection

> A new Mirai-variant botnet is actively recruiting D-Link DIR-823X SOHO routers by chaining CVE-2025-29635 — an authenticated OS command injection in the /goform/set_prohibiting endpoint (firmware 240126 and 240802) — with default and weak credential reuse. Compromised devices are flashed with MIPS/ARM Mirai payloads and enlisted into DDoS staging fleets. An adjacent cluster of command-injection CVEs (CVE-2026-2129 set_ac_status, CVE-2026-2142 set_qos, CVE-2026-2143 set_ddns) on DIR-823X firmware 250416 indicates an expanding /goform/ attack surface against the same device family.

- **Published:** 2026-04-21T12:00:00Z
- **Last reviewed:** 2026-04-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0406
- **ID:** TL-2026-0406
- **Severity:** HIGH (CVSS 8.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Mirai Botnet Operator
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-29635, CVE-2026-2129, CVE-2026-2142, CVE-2026-2143

## Description

Threadlinqs Intelligence is tracking a Mirai-variant botnet campaign (observed by Akamai SIRT in April 2026) that is actively recruiting D-Link DIR-823X SOHO routers at scale. The primary exploitation primitive is CVE-2025-29635, an OS command injection in the router's web-administration binary reachable through HTTP POST requests to /goform/set_prohibiting. The affected function consumes user-controlled parameters from the POST body and passes them into a system()/popen() sink without sanitization, allowing arbitrary shell metacharacters (;, &&, |, backticks, $(...)) to break out of the intended argument context and execute attacker commands in the router's BusyBox shell as root.

Although NVD scores the issue PR:L (requires authentication), Mirai operators routinely bypass this pre-condition in three ways: (1) reuse of leaked / factory-default credentials (admin/admin, admin/password, blank), (2) brute-force of the administrative interface over HTTP(S) on exposed WAN management, and (3) chaining with adjacent unauthenticated information-disclosure or session-handling weaknesses on the same device. Once authenticated, the injected command typically wgets a small downloader (e.g. /tmp/dlr) which then chain-loads architecture-specific Mirai binaries (mips, mipsel, arm5/6/7, x86) from an attacker-controlled HTTP server.

The recruited implants fork, rename their process to mimic legitimate daemons (dropbear, telnetd, [kworker]), open a raw socket for SYN/GRE/UDP DDoS attack vectors, and establish a long-lived TCP session to a hardcoded or DGA-derived C2 on ports 1312 / 23 / 666 / 8080. Killer routines attempt to remove competing botnets (Qbot, Gafgyt, Hajime, Mozi) and to disable firmware update services. Persistence is weak — Mirai classically lives in /tmp and volatile RAM — so the botnet relies on continuous reinfection via the same exploit chain to maintain fleet size across router reboots.

The DIR-823X /goform/ endpoint family is showing sustained researcher and attacker interest. Within a two-month window in early 2026, VulDB/master-abc disclosed three additional command-injection issues on firmware 250416: CVE-2026-2129 (set_ac_status, parameters ac_ipaddr / ac_ipstatus / ap_randtime), CVE-2026-2142 (set_qos, function sub_420688), and CVE-2026-2143 (set_ddns, DDNS-Service parameters ddnsType / ddnsDomainName / ddnsUserName / ddnsPwd). All share the same root cause class (CWE-77 / CWE-78), the same privilege precondition (PR:H), and all have public PoC exploits. Defenders should treat the DIR-823X web-admin surface as fully compromised and assume any exposed device is recruitable.

D-Link has not shipped a patched firmware for the DIR-823X as of the reporting window; the device is EoL / end-of-service in several regions. Defenders should treat exposed DIR-823X devices as unfixable and remove them from the edge — particularly any with WAN-side HTTP management enabled.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1543 Create or Modify System Process
- T1036 Masquerading
- T1070 Indicator Removal
- T1222 File and Directory Permissions Modification
- T1110 Brute Force
- T1555 Credentials from Password Stores
- T1046 Network Service Discovery
- T1057 Process Discovery
- T1210 Exploitation of Remote Services
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1498 Network Denial of Service
- T1499 Endpoint Denial of Service
- T1496 Resource Hijacking

## Sources

- [NVD — CVE-2025-29635 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-29635)
- [MITRE CVE Record — CVE-2025-29635](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29635)
- [INCIBE-CERT Early Warning — CVE-2025-29635](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2025-29635)
- [mono7s — DIR-823X set_prohibiting PoC Writeup](https://github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting.md)
- [RedPacketSecurity — CVE-2026-2129 D-Link DIR-823X](https://www.redpacketsecurity.com/cve-alert-cve-2026-2129-d-link-dir-823x/)
- [NVD — CVE-2026-2129 Detail (set_ac_status)](https://nvd.nist.gov/vuln/detail/CVE-2026-2129)
- [NVD — CVE-2026-2142 Detail (set_qos)](https://nvd.nist.gov/vuln/detail/CVE-2026-2142)
- [NVD — CVE-2026-2143 Detail (set_ddns)](https://nvd.nist.gov/vuln/detail/CVE-2026-2143)
- [master-abc — DIR-823X set_ac_status PoC](https://github.com/master-abc/cve/issues/23)
- [master-abc — DIR-823X set_qos PoC](https://github.com/master-abc/cve/issues/29)
- [master-abc — DIR-823X set_ddns PoC](https://github.com/master-abc/cve/issues/25)
- [VulDB — CVE-2026-2129 Entry](https://vuldb.com/?id.344764)
- [VulDB — CVE-2026-2142 Entry](https://vuldb.com/?id.344777)
- [VulDB — CVE-2026-2143 Entry](https://vuldb.com/?id.344778)
- [Akamai SIRT — Active Exploitation: Mirai IoT Botnet Research (series)](https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0406