CVE-2025-60697

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-60697
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` function in `prog.cgi` stores user-supplied DDNS parameters (`ServerAddress` and `Hostname`) in NVRAM via `nvram_safe_set`. These values are later retrieved in the `start_DDNS_ipv4` function of `rc` using `nvram_safe_get` and concatenated into DDNS shell commands executed via `twsystem()` without proper sanitization. Partial string comparison is performed but is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/4.md Broken Link
https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/CVE-2025-60697.md Exploit Third Party Advisory
https://www.dlink.com/ Product
https://www.dlink.com/en/security-bulletin/ Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dir-882_firmware:1.02b02:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-882:a1:*:*:*:*:*:*:*
History

17 Nov 2025, 12:29

Type Values Removed Values Added
CPE cpe:2.3:o:dlink:dir-882_firmware:1.02b02:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-882:a1:*:*:*:*:*:*:*
References () https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/4.md - () https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/4.md - Broken Link
References () https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/CVE-2025-60697.md - () https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/CVE-2025-60697.md - Exploit, Third Party Advisory
References () https://www.dlink.com/ - () https://www.dlink.com/ - Product
References () https://www.dlink.com/en/security-bulletin/ - () https://www.dlink.com/en/security-bulletin/ - Vendor Advisory
First Time Dlink dir-882
Dlink
Dlink dir-882 Firmware

13 Nov 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.3
CWE CWE-77

13 Nov 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-13 18:15

Updated : 2025-11-17 12:29

NVD link : CVE-2025-60697

Mitre link : CVE-2025-60697

CVE.ORG link : CVE-2025-60697

JSON object : View

Products Affected

dlink

  • dir-882
  • dir-882_firmware
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')