CVE-2025-29635

Think of your router like the office’s traffic control desk. This bug lets a person who already has the ability to act as an authorized user send a specially crafted request to the router, and trick it into running commands—like giving the attacker a remote “do anything” console. That can lead to control of the router itself, which can disrupt internet service and expose your business network.

This matters if you run a D-Link DIR-823X AX3000 router on firmware 240126 or 240802. The vulnerability requires an authorized attacker (so it’s not a simple “anyone can hit the router and get in” flaw), and it is triggered by a remote POST request to /goform/set_prohibiting. Treat it as a real risk if an attacker can reach the router interface that handles this function and has already obtained authorized access (for example, via compromised admin credentials or another compromise path).

This is RED because CISA has confirmed it as a known exploited vulnerability (KEV), meaning it’s considered actively relevant in the real world. With a CISA remediation due date of 2026-05-08, you should treat routers running 240126/240802 as needing immediate action to remove or mitigate the exposure.