PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
high·Network Vulnerabilities·Updated Jun 28, 2026

D-Link DIR-823X set_prohibiting - Command Injection

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
3.2k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVECVE-2025-29635
7.2
CVSShigh
Exploitable remotely over the internet · requires high privileges.

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

Attack Vector
Network
Privileges Req.
High
User Interaction
None
Affected
n/aby n/a
n/a
Updated Sep 9, 2026View on NVD →
Similar Tools
high
Guralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)
→medium
GeoServer - XML External Entity Injection
→medium
SMB - Default Logins
→medium
FortiOS - Insecure LDAP Configuration Detection
→medium
Widget4Call WordPress - Cross-Site Scripting
→medium
OWL Carousel Slider - Cross-Site Scripting
→medium
FortiOS - Insecure LDAP Configuration Detection
→medium
Avigilon ACM - Host Header Injection
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

D-Link DIR-823X set_prohibiting - Command Injection CVE-2025-29635 Scanner | S4E