PT-2025-46885 · D Link · D-Link Dir-878A1

Published 2025-11-13 · Updated 2025-11-23 · CVE-2025-60672

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-878A1 router firmware versions prior to FW101B04

Description An unauthenticated command injection issue exists in the D-Link DIR-878A1 router firmware. The problem is located in the SetDynamicDNSSettings functionality. Specifically, the ServerAddress and Hostname parameters within the prog.cgi script are not properly sanitized before being stored in NVRAM. These parameters are subsequently used by rc to build and execute system commands via the twsystem() function. A remote attacker can exploit this without authentication by sending a crafted HTTP request, resulting in arbitrary command execution on the device.

Recommendations Update to firmware version FW101B04 or later.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14839

CVE-2025-60672

Affected Products

D-Link Dir-878A1

References · 10

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60672.md · Exploit
• https://bdu.fstec.ru/vul/2025-14839 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-60672 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60672 · Vendor Advisory
• http://d-link.com · Note
• https://t.me/CSIRT_italia/2925 · Telegram Post
• https://dlink.com/en · Note
• https://twitter.com/rfwaveio/status/1992598423418347753 · Twitter Post
• https://t.me/true_secator/7652 · Telegram Post