PT-2025-46882 · D Link · D-Link Dir-882 Router

Published 2025-11-13 · Updated 2025-11-13 · CVE-2025-60698

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions D-Link DIR-882 Router firmware version DIR882A1 FW102B02

Description A command injection issue exists in the D-Link DIR-882 Router firmware. The sub 432F60 function within the prog.cgi binary stores user-supplied SetSysLogSettings/IPAddress values in NVRAM using nvram safe set("SysLogRemote IPAddress", ...). Subsequently, the sub 448DCC function in the rc binary retrieves these values using nvram safe get and incorporates them into a shell command executed via twsystem() without proper sanitization. An unauthenticated remote attacker can exploit this to execute arbitrary commands on the device by sending specially crafted HTTP requests to the router's web interface. The vulnerable binaries are prog.cgi and rc.

Recommendations Update to a newer version of the D-Link DIR-882 Router firmware that addresses this issue.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14841

CVE-2025-60698

Affected Products

D-Link Dir-882 Router

References · 8

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/CVE-2025-60698.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-60698 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14841 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60698 · Security Note
• https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/2.md · Note
• https://t.me/CVEtracker/37274 · Telegram Post
• https://dlink.com · Note