Mirai Botnet Exploits End-of-Life D-Link Routers via RCE
A new Mirai botnet campaign is actively exploiting a critical command injection vulnerability (CVE-2025-29635) in end-of-life D-Link DIR-823X routers. BleepingComputer reports that this flaw allows attackers to remotely execute code, enlisting these compromised devices into the Mirai botnet for launching distributed denial-of-service (DDoS) attacks.
This campaign highlights a persistent threat: the exploitation of unpatched, legacy devices. Organizations still running these vulnerable D-Link routers, especially those exposed to the internet, are prime targets. Defenders must prioritize identifying and decommissioning or isolating end-of-life hardware to prevent it from becoming a pivot point for botnets.
What This Means For You
- If your organization has deployed D-Link DIR-823X routers, immediately conduct an inventory of all network devices to identify any still in use. Isolate or decommission any identified units from the network and verify they are not publicly accessible. Prioritize upgrading to supported hardware to eliminate this known RCE vector.
Related ATT&CK Techniques
🛡️ Detection Rules
1 rule · 6 SIEM formats1 detection rule auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Exploitation Attempt — D-Link
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2025-29635 | RCE | D-Link DIR-823X routers |
| CVE-2025-29635 | Command Injection | D-Link DIR-823X routers |
Written by SCW Vulnerability Desk
Related Posts
Apple Patches iOS Notification Data Retention Flaw
Apple has issued out-of-band security updates for iOS and iPadOS, addressing a critical flaw in its Notification Services. BleepingComputer reports this vulnerability could allow notification...
North Korean Hackers Net Over $12M in Q1 2026 Crypto Scams
North Korean-linked threat actors have reportedly siphoned over $12 million from cryptocurrency users during the first three months of 2026. The campaign leveraged malware deployed...
CISA Director Nominee Sean Plankey Withdraws, Agency Faces Leadership Void
Sean Plankey, the long-standing nominee for Director of the Cybersecurity and Infrastructure Security Agency (CISA), has formally withdrawn his nomination, according to CyberScoop. After 13...