How severe is CVE-2025-29635?

CVE-2025-29635 has a CVSS score of 7.2/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2025-29635?

Affected package information for CVE-2025-29635 is not yet fully mapped. Check the official advisory links for details.

How do I fix CVE-2025-29635?

No fixed release is recorded for CVE-2025-29635 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.

How do I detect CVE-2025-29635 in my code and dependencies?

Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

How do I mitigate CVE-2025-29635 if there is no patch (or I can't update yet)?

Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

Is CVE-2025-29635 actively exploited in the wild?

No public exploit code has been indexed for CVE-2025-29635 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2025-29635?

CVE-2025-29635 has an EPSS (Exploit Prediction Scoring System) score of 87.9%, placing it in the 100th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. A score above 50% indicates significantly elevated exploitation risk — immediate patching is strongly recommended.

Is CVE-2025-29635 in the CISA Known Exploited Vulnerabilities catalog?

Yes. CVE-2025-29635 (D-Link DIR-823X Command Injection Vulnerability) was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-04-24. CISA required all US federal civilian agencies to remediate this vulnerability by 2026-05-08. The required action was: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Being listed in the KEV catalog is the strongest possible confirmation of active exploitation — treat this as a critical priority.

What type of vulnerability is CVE-2025-29635?

CVE-2025-29635 is classified as CWE-77 (CWE-77). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

Is there exploit tooling available for CVE-2025-29635?

A Nuclei detection template exists for CVE-2025-29635, meaning automated scanners can fingerprint it. Public exploit tooling significantly increases real-world risk — prioritize patching and ensure detection coverage. Exploit tooling should only ever be used in isolated, authorized testing environments.

When was CVE-2025-29635 published, and has it been updated?

CVE-2025-29635 was published on March 25, 2025 and was last updated on April 25, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🛡️

CISA KEV · ACTIVELY EXPLOITED

HIGH severity

CVE-2025-29635 — Mono7s

HIGH

CVE-2025-29635 is a high-severity (CVSS 7.2) CWE-77 vulnerability. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-04-24) — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting…

Published

Mar 25, 2025

Updated

Apr 25, 2026

Affected

1 product

Patched

See advisory

Exploits

None indexed

Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-04-24. Federal agencies were required to remediate by 2026-05-08.
A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2025-29635.

EPSS Exploitation Probability

via FIRST.org ↗

87.9%probability of exploitation in next 30 days

Very High Risk0.00%

Lower risk than most CVEs100th percentile — riskier than 100% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2025-29635 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the 50–90% band (highlighted). Counts from FIRST.org, log-scaled.

Description

Affected Products

1 product · 2 configurations

dir-823x firmwaredlink

2 versions

240126240802

Detection & mitigation playbook

Vulnerability

Detect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2025-29635 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

How to detect CVE-2025-29635

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2025-29635 -u https://target

Template: D-Link DIR-823X set_prohibiting - Command Injection
Severity: high
Impact: Attackers can execute arbitrary commands on the device remotely, potentially leading to full device compromise.
Remediation: Update to the latest firmware version provided by D-Link or contact vendor for patches.

Template by ProjectDiscovery nuclei-templates (pussycat0x), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

O3 Security · Impact-Aware SCA

Is CVE-2025-29635 in your dependencies?

Find it across , including transitive dependencies.

Scan my dependencies How O3 SCA works

CVSS Score

7.2/10CVSS v3 base

Vector breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Raw vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE Classification

Weaponization

Timeline

Disclosed

Mar 25, 2025

KEV added

Apr 24, 2026

Last updated

Apr 25, 2026

Identifiers

CVE-2025-29635

References

Advisoryakamai.com Webgithub.com Webcisa.gov

Related vulnerabilities

This CVE is high severity; 7 of 8 other CVEs with CWE-77 are rated as high or higher (top: critical).

CVE-2026-112942CVE-2026-102827CVE-2026-102826GHSA-jqmf-mx4f-hfr6CVE-2026-55182GHSA-jf24-8g2h-2wg7CVE-2026-28672CVE-2026-54680Browse all CWE-77

Provenance

Sources

OSV.devNVDCISA KEVFIRST.org (EPSS)

Last verifiedApr 25, 2026

CVE-2025-29635 — Mono7s

Exploitation Status

Actively exploited in the wild

EPSS Exploitation Probability

How urgent is this, really

Where this sits among everything scored

Description

Affected Products

Detection & mitigation playbook

Detect

Remediation status

Mitigate without a patch

How to detect CVE-2025-29635

Frequently Asked Questions

Is CVE-2025-29635 in your dependencies?