A Mirai botnet is targeting discontinued D-Link routers impacted by a command injection vulnerability disclosed a year ago, Akamai reports.
Tracked as CVE-2025-29635, the security defect exists because an attacker-controllable function value is copied without validation, and can be exploited through crafted POST requests.
“The router extracts the value that ends up in the command buffer from the request body without checking which form field it came from,” Akamai notes.
The observed exploitation attempts, it says, target the same code and trigger the same system call as a proof-of-concept (PoC) exploit published last year on GitHub, which has since been removed.
As part of the observed execution path, a shell script is loaded to download and run a payload that has numerous Mirai characteristics, including XOR encoding, a hardcoded console execution string, and a hardcoded downloader IP.
The exploited issue exists in D-Link DIR-823X series router firmware versions 240126 and 24082. The affected devices were discontinued last year and no longer receive software updates from the vendor.
“D-Link strongly recommends that this product be retired and cautions that any further use of this product may be a risk to devices connected to it,” the company warned in September.
The hackers have been observed targeting TP-Link and ZTE router vulnerabilities as well, Akamai says.
The threat actor behind the recently observed attacks appears not to have used vibe coding to build their payload.
“Mirai malware campaigns continue to plague the industry, with much of the original source code continuing to be reused by various threat actors, both skilled and unskilled. The low barrier of entry and potential financial benefits are some of the incentives that may entice individuals to enter the botnet space and become a cyberthreat actor,” Akamai notes.
Related: Evasive Masjesu DDoS Botnet Targets IoT Devices
Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation
Related: 174 Vulnerabilities Targeted by RondoDox Botnet
Related: Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience
