A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit file. The vulnerability occurs because content read from this file is only partially validated for a prefix and then formatted using vsnprintf() before being executed with system(), allowing an attacker with write access to /var/system/linux_vlan_reinit to execute arbitrary commands on the device.
References
| Link | Resource |
|---|---|
| http://d-link.com | Product |
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-823G/CVE-2025-60671.md | Exploit Third Party Advisory |
| https://www.dlink.com/en | Product |
| https://www.dlink.com/en/security-bulletin/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
17 Nov 2025, 19:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dlink dir-823g Firmware
Dlink Dlink dir-823g |
|
| CPE | cpe:2.3:o:dlink:dir-823g_firmware:1.0.2b05_20181207:*:*:*:*:*:*:* cpe:2.3:h:dlink:dir-823g:-:*:*:*:*:*:*:* |
|
| References | () http://d-link.com - Product | |
| References | () https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-823G/CVE-2025-60671.md - Exploit, Third Party Advisory | |
| References | () https://www.dlink.com/en - Product | |
| References | () https://www.dlink.com/en/security-bulletin/ - Vendor Advisory |
14 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
14 Nov 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-77 |
13 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-13 18:15
Updated : 2025-11-17 19:04
NVD link : CVE-2025-60671
Mitre link : CVE-2025-60671
CVE.ORG link : CVE-2025-60671
JSON object : View
Products Affected
dlink
- dir-823g
- dir-823g_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')