PT-2025-46886 · D Link · D-Link Dir-878A1

Published 2025-11-12 · Updated 2025-11-23 · CVE-2025-60673

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-878A1 router firmware versions prior to FW101B04

Description An unauthenticated command injection issue exists in the 'SetDMZSettings' functionality of the D-Link DIR-878A1 router. The IPAddress parameter within the prog.cgi script is vulnerable because it is not properly sanitized before being stored in NVRAM. This parameter is subsequently used by librcm.so to construct iptables commands, which are then executed via the twsystem() function. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP request to execute arbitrary commands on the device.

Recommendations Update to firmware version FW101B04 or later.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14674

CVE-2025-60673

Affected Products

D-Link Dir-878A1

References · 10

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60673.md · Exploit
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60673 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60673 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14674 · Security Note
• http://d-link.com · Note
• https://t.me/CSIRT_italia/2925 · Telegram Post
• https://dlink.com/en · Note
• https://t.me/true_secator/7652 · Telegram Post
• https://twitter.com/rfwaveio/status/1992598423418347753 · Twitter Post