Mirai Campaign Exploits CVE-2025-29635 in End-of-Life D-Link Routers
Summary
Akamai SIRT observed attempts exploiting CVE-2025-29635 in D-Link DIR-823X routers, deploying the multi-architecture Mirai variant tuxnokill. The models reached end of life in November 2024; users are advised to upgrade and secure router access.
Key points
- Akamai SIRT observed exploitation attempts in its honeypots in early March 2026.
- The command-injection flaw affects D-Link DIR-823X firmware versions 240126 and 24082; attackers send POST requests to /goform/set_prohibiting.
- Observed activity downloads and runs a shell script named dlink.sh that installs the multi-architecture Mirai variant tuxnokill.
- The malware supports TCP and UDP floods and HTTP null attacks.
- Akamai also observed the actor exploiting CVE-2023-1389 in TP-Link routers and an RCE flaw in ZTE ZXV10 H108L routers.
- The affected D-Link models reached end of life in November 2024, and a vendor patch is considered unlikely. Recommended steps include upgrading, disabling unneeded remote administration, changing default passwords, and monitoring configuration changes.
Article Details
- Vulnerability Types
- Command injection
- Remote code execution (RCE)
- Severity
- High
- Affected Versions
- D-Link DIR-823X firmware 240126
- D-Link DIR-823X firmware 24082
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- unknown
- Workarounds
- Upgrade to a newer router model that receives active security support.
- Disable remote administration portals if they are not needed.
- Change default administrator passwords.
- Monitor for unexpected configuration changes.
MITRE ATT&CK
T1059.004 · Unix ShellThe downloaded shell script is executed on compromised routers to install the payload.T1105 · Ingress Tool TransferAttackers download a shell script, dlink.sh, from an external IP; the script installs the Mirai-based payload.T1190 · Exploit Public-Facing ApplicationThe campaign exploits CVE-2025-29635 through the D-Link DIR-823X router's /goform/set_prohibiting endpoint to gain remote command execution.T1498.001 · Direct Network FloodThe deployed Mirai variant supports TCP and UDP floods and HTTP-based DDoS attacks.
CVE
CVE-2023-1389Tp-link · Archer ax21 firmwareAkamai has also found that the threat actor behind this campaign also exploits CVE-2023-1389, impacting TP-Link routers, and a separate RCE flaw in ZTE ZXV10 H108L routers.CVE-2025-29635Dlink · Dir-823x firmwareA Mirai-based botnet campaign is actively exploiting CVE-2025-29635 in D-Link DIR-823X routers to execute commands via a POST to /goform/set_prohibiting and enlist devices.
People
Malware
MiraiA Mirai-based botnet campaign is actively exploiting CVE-2025-29635 in D-Link DIR-823X routers to execute commands via a POST to /goform/set_prohibiting and enlist devices.tuxnokillactivity in March 2026 and found attackers download and run a multi-architecture Mirai variant called “tuxnokill,” while affected models reached end-of-life in November 2024, making vendor fixes unlikely.
Vendors
D-LinkA Mirai-based botnet campaign is actively exploiting CVE-2025-29635 in D-Link DIR-823X routers to execute commands via a POST to /goform/set_prohibiting and enlist devices.TP-LinkAkamai has also found that the threat actor behind this campaign also exploits CVE-2023-1389, impacting TP-Link routers, and a separate RCE flaw in ZTE ZXV10 H108L routers.ZTEAkamai has also found that the threat actor behind this campaign also exploits CVE-2023-1389, impacting TP-Link routers, and a separate RCE flaw in ZTE ZXV10 H108L routers.
Products
D-Link DIR-823XA Mirai-based botnet campaign is actively exploiting CVE-2025-29635 in D-Link DIR-823X routers to execute commands via a POST to /goform/set_prohibiting and enlist devices.TP-Link routersAkamai has also found that the threat actor behind this campaign also exploits CVE-2023-1389, impacting TP-Link routers, and a separate RCE flaw in ZTE ZXV10 H108L routers.ZTE ZXV10 H108LAkamai has also found that the threat actor behind this campaign also exploits CVE-2023-1389, impacting TP-Link routers, and a separate RCE flaw in ZTE ZXV10 H108L routers.