PT-2025-46888 · D Link · Dir-823

Published 2025-11-13 · Updated 2025-11-13 · CVE-2025-60675

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G router firmware version 1.0.2B05 20181207

Description A command injection issue exists due to insufficient data sanitization when processing the /tmp/new qos.rule configuration file. The timelycheck and sysconf binaries are affected as they concatenate parsed fields from this file into command strings and execute them using the system() function. An attacker who can write to /tmp/new qos.rule can execute arbitrary commands on the device.

Recommendations Update to a newer version of the firmware that addresses this vulnerability. As a temporary workaround, restrict write access to the /tmp/new qos.rule file to prevent unauthorized modification.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14837

CVE-2025-60675

Affected Products

Dir-823

References · 7

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-823G/CVE-2025-60675.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-60675 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14837 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60675 · Security Note
• http://d-link.com · Note
• https://dlink.com/en · Note