CVE-2025-29635 PoC — D-Link DIR-823X 命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-29635.yaml

Associated Vulnerability

Title:D-Link DIR-823X 命令注入漏洞 (CVE-2025-29635)
Description:A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

Description

D-Link DIR-823X 240126 and 240802 contain a command injection caused by sending a POST request to /goform/set_prohibiting, letting an authorized attacker execute arbitrary commands remotely, exploit requires attacker to be authorized.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →