PT-2025-46889 · D Link · D-Link Dir-878A1

Published 2025-11-12 · Updated 2025-11-23 · CVE-2025-60676

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-878A1 router firmware versions prior to FW101B04

Description An unauthenticated command injection issue exists in the D-Link DIR-878A1 router firmware. The problem is located in the SetNetworkSettings functionality within the prog.cgi script. The IPAddress and SubnetMask parameters are directly incorporated into shell commands executed using the system() function. An attacker can remotely execute arbitrary commands on the device by sending a crafted HTTP request, without needing authentication. The vulnerability stems from a lack of input sanitization on the management level.

Recommendations Update the router firmware to version FW101B04 or later.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14690

CVE-2025-60676

Affected Products

D-Link Dir-878A1

References · 10

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md · Exploit
• https://bdu.fstec.ru/vul/2025-14690 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-60676 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60676 · Vendor Advisory
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://t.me/true_secator/7652 · Telegram Post
• http://d-link.com · Note
• https://dlink.com/en · Note
• https://t.me/CSIRT_italia/2925 · Telegram Post
• https://twitter.com/rfwaveio/status/1992598423418347753 · Twitter Post