Note: This analysis is based on publicly available information from source article. Facts are clearly separated from technical analysis.
Executive Summary
In March 2026, Akamai's SIRT detected active exploitation attempts of the D-Link command injection vulnerability CVE-2025-29635. This high-severity vulnerability affects D-Link DIR-823X routers in firmware versions 240126 and 24082, allowing an attacker to execute arbitrary commands on remote devices by sending a POST request to a vulnerable endpoint. The threat actor behind this campaign also exploits CVE-2023-1389, impacting TP-Link routers, and a separate RCE flaw in ZTE ZXV10 H108L routers. The Mirai-based malware named 'tuxnokill' supports multiple architectures and features Mirai's standard distributed denial-of-service (DDoS) attack repertoire.
The impact of this incident is significant, with D-Link being the primary affected company. The duration of the flaw being first disclosed is 13 months, indicating a prolonged period of vulnerability. The severity of the incident is high, with infrastructure-outage being the primary category.
This incident matters because it highlights the importance of timely vulnerability disclosure and patching. It also emphasizes the need for organizations to have robust security measures in place to detect and prevent such attacks.
What Happened: Timeline
✅ Verified Facts
- March 2026: Akamai's SIRT detected active exploitation attempts of the D-Link command injection vulnerability CVE-2025-29635.
- April 22, 2026: The article was published.
Technical Deep Dive
Understanding Mirai
What is it?
Mirai is a malware that was first discovered in 2016. It is a type of IoT botnet that uses compromised devices to conduct distributed denial-of-service (DDoS) attacks. Mirai is designed to infect IoT devices, such as routers, cameras, and other smart devices, and use them to launch massive DDoS attacks against targeted websites or networks.
How does it work?
Mirai uses a combination of techniques to infect devices and launch attacks. First, it scans for vulnerable devices using a list of known vulnerabilities. Once a device is identified as vulnerable, Mirai sends a malicious payload to the device, which infects it. The infected device is then added to the Mirai botnet, which is controlled by the attacker. The attacker can then use the botnet to launch DDoS attacks against targeted websites or networks.
Security considerations
Mirai is a significant security threat because it can be used to launch massive DDoS attacks that can take down even the largest and most secure websites. Mirai is also highly resilient, making it difficult to detect and remove. Additionally, Mirai can be used to conduct other types of attacks, such as data theft and ransomware.
Understanding CVE-2025-29635
What is it?
CVE-2025-29635 is a high-severity command-injection vulnerability that affects D-Link DIR-823X routers in firmware versions 240126 and 24082. The vulnerability allows an attacker to execute arbitrary commands on remote devices by sending a POST request to a vulnerable endpoint.
How does it work?
The vulnerability exists in the /goform/set_prohibiting endpoint, which can be accessed using a POST request. An attacker can send a malicious POST request to the endpoint, which can execute arbitrary commands on the device.
Security considerations
CVE-2025-29635 is a significant security threat because it allows an attacker to execute arbitrary commands on remote devices. This can be used to conduct a variety of attacks, including DDoS attacks, data theft, and ransomware.
Understanding CVE-2023-1389
What is it?
CVE-2023-1389 is a high-severity vulnerability that affects TP-Link routers. The vulnerability allows an attacker to execute arbitrary commands on remote devices by sending a POST request to a vulnerable endpoint.
How does it work?
The vulnerability exists in the /goform/set_prohibiting endpoint, which can be accessed using a POST request. An attacker can send a malicious POST request to the endpoint, which can execute arbitrary commands on the device.
Security considerations
CVE-2023-1389 is a significant security threat because it allows an attacker to execute arbitrary commands on remote devices. This can be used to conduct a variety of attacks, including DDoS attacks, data theft, and ransomware.
Analysis: What Went Wrong
📊 Professional Analysis
Technical Root Cause
The technical root cause of this incident is the existence of the CVE-2025-29635 vulnerability in D-Link DIR-823X routers. The vulnerability allows an attacker to execute arbitrary commands on remote devices, which can be used to conduct a variety of attacks.
Contributing Factors
The contributing factors to this incident include:
- The prolonged period of vulnerability (13 months)
- The lack of timely vulnerability disclosure and patching
- The existence of other vulnerabilities, such as CVE-2023-1389, that can be exploited by attackers
Lessons for Security Professionals
Key Takeaways
- Timely vulnerability disclosure and patching are crucial: Organizations must have robust security measures in place to detect and prevent vulnerabilities.
- Regular security audits and testing are essential: Organizations must regularly conduct security audits and testing to identify vulnerabilities and address them before they can be exploited.
- Employee education and awareness are critical: Employees must be educated and aware of the importance of security and the potential risks associated with vulnerabilities.
Prevention & Detection
How to Prevent
- Regularly update and patch devices and software
- Conduct regular security audits and testing
- Implement robust security measures, such as firewalls and intrusion detection systems
- Educate employees on security best practices
How to Detect
- Monitor network traffic and system logs for suspicious activity
- Use intrusion detection systems and security information and event management (SIEM) systems
- Conduct regular vulnerability assessments and penetration testing
- Use threat intelligence and incident response planning to detect and respond to potential threats
Related Certification Topics
View related certification topics
Security+
- Domain 1.0: Security and Risk Management
- Domain 2.0: Asset Security
- Domain 3.0: Security Architecture and Engineering
- Domain 4.0: Communication and Network Security
- Domain 5.0: Identity and Access Management
- Domain 6.0: Security Assessment and Testing
- Domain 7.0: Security Operations and Administration
CySA+
- Domain 1.0: Security and Risk Management
- Domain 2.0: Asset Security
- Domain 3.0: Security Architecture and Engineering
- Domain 4.0: Communication and Network Security
- Domain 5.0: Identity and Access Management
- Domain 6.0: Security Assessment and Testing
- Domain 7.0: Security Operations and Administration
CISSP
- Domain 1: Security and Risk Management
- Domain 2: Asset Security
- Domain 3: Security Architecture and Engineering
- Domain 4: Communication and Network Security
- Domain 5: Identity and Access Management
- Domain 6: Security Assessment and Testing
- Domain 7: Security Operations and Administration
OSCP
- Domain 1: Network Security
- Domain 2: System Security
- Domain 3: Cryptography
- Domain 4: Web Application Security
- Domain 5: Penetration Testing
CISM
- Domain 1: Information Security Governance
- Domain 2: Information Risk Management
- Domain 3: Information Security Program Management
- Domain 4: Information Security Incident Management
CISM
- Domain 1: Information Security Governance
- Domain 2: Information Risk Management
- Domain 3: Information Security Program Management
- Domain 4: Information Security Incident Management
Source (1)
This analysis is based on: https://www.bleepingcomputer.com/news/security/new-mirai-campaign-exploits-rce-flaw-in-eol-d-link-routers/
This incident analysis is provided for educational purposes. Facts are cited from the source article, while technical analysis represents professional interpretation.