PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-29635 D-Link CVE debrief

CVE-2025-29635 is a D-Link DIR-823X command injection vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2026-04-24. Because it is listed in KEV, defenders should treat it as a high-priority remediation item and follow vendor mitigation guidance or discontinue use of the product if mitigations are unavailable.

Vendor
D-Link
Product
DIR-823X
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2026-04-24
Original CVE updated
2026-04-24
Advisory published
2026-04-24
Advisory updated
2026-04-24

Who should care

Organizations that own, manage, or expose D-Link DIR-823X devices should care immediately, especially security teams, network administrators, and anyone responsible for internet-facing edge devices or small-office/home-office routers.

Technical summary

The available source corpus identifies the issue as a command injection vulnerability affecting the D-Link DIR-823X. CISA’s KEV entry records the product, vulnerability name, date added, and a remediation requirement pointing to vendor instructions. No CVSS score or deeper technical exploitation details were provided in the supplied sources.

Defensive priority

High. CISA has placed this CVE in the Known Exploited Vulnerabilities catalog, which makes it time-sensitive. The due date in the KEV record is 2026-05-08.

Recommended defensive actions

  • Apply mitigations per D-Link’s vendor instructions referenced by CISA.
  • Prioritize remediation before the CISA KEV due date of 2026-05-08.
  • If mitigations are unavailable, discontinue use of the D-Link DIR-823X as CISA advises.
  • Inventory all DIR-823X devices and confirm whether any are exposed to untrusted networks.
  • Monitor vendor and CISA guidance for updated remediation steps or product-specific notices.

Evidence notes

CISA’s KEV source entry explicitly lists CVE-2025-29635 as “D-Link DIR-823X Command Injection Vulnerability,” with vendorProject D-Link, product DIR-823X, dateAdded 2026-04-24, and dueDate 2026-05-08. The KEV metadata also cites a D-Link support announcement labeled SAP10469 and the NVD CVE detail page as supporting references. No CVSS score was supplied in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-29635 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-29635

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-29635 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-29635

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.