Vulnerabilities

CVSS

7.2 High

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2025-03-25

Status

Analyzed

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

Weaknesses

CWE-77

Coverage 1

malware

RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS

A new botnet, RustDuck, is leveraging Rust programming to hijack routers, IP cameras, and servers for DDoS attacks. Developed by QiAnXin's XLab, the botnet utilizes a two-stage approach, exploiting vulnerabilities in dev…

The Hacker News · Jun 30, 2026 High

CVE-2017-17215CVE-2025-29635CVE-2024-1781CNddosbotnetrust

All articles mentioning it

Advisories and references

• github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting...
• akamai.com/blog/security-research/2026/apr/cve-2025-29635-mirai-camp...
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...