Command Injection Vulnerability (CVE-2025-29635) Exploited in the Wild

Akamai SIRT reports active exploitation of CVE-2025-29635 against end-of-life D-Link DIR-823X routers, where a POST to the /goform/set_prohibiting endpoint enables remote command execution and infection by a Mirai variant; the activity was observed in honeypots and organizations are urged to retire EOL devices, apply patches or network protections, and monitor disclosures.