A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling module. The vulnerability occurs when the "Serial Number" field from a USB device is read via sscanf into a 64-byte stack buffer, while fgets reads up to 127 bytes, causing a stack overflow. An attacker with physical access or control over a USB device can exploit this vulnerability to potentially execute arbitrary code on the device.
References
| Link | Resource |
|---|---|
| http://d-link.com | Product |
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60674.md | Exploit Third Party Advisory |
| https://www.dlink.com/en | Product |
| https://www.dlink.com/en/security-bulletin/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
17 Nov 2025, 19:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dlink dir-878
Dlink Dlink dir-878 Firmware |
|
| References | () http://d-link.com - Product | |
| References | () https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60674.md - Exploit, Third Party Advisory | |
| References | () https://www.dlink.com/en - Product | |
| References | () https://www.dlink.com/en/security-bulletin/ - Vendor Advisory | |
| CPE | cpe:2.3:h:dlink:dir-878:a1:*:*:*:*:*:*:* cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:* |
14 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.8 |
14 Nov 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-121 |
13 Nov 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-13 19:15
Updated : 2025-11-17 19:04
NVD link : CVE-2025-60674
Mitre link : CVE-2025-60674
CVE.ORG link : CVE-2025-60674
JSON object : View
Products Affected
dlink
- dir-878
- dir-878_firmware
CWE
CWE-121
Stack-based Buffer Overflow