RCE in Dlink Dir-882
CVE-2025-60697
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` function in `prog.cgi` stores user-supplied DDNS parameters (`ServerAddress` and `Hostname`) in NVRAM via `nvram_safe_set`. These values are later retrieved in the `start_DDNS_ipv4` function of `rc` using `nvram_safe_get` and concatenated into DDNS shell commands executed via `twsystem()` without proper sanitization. Partial string comparison is performed but is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.038 (89.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 89.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.038 · newest: 0.038 · change: 0.000
Affected products
- Dlink Dir-882 — versions a1
- Dlink Dir-882 Firmware — versions 1.02b02
Weakness classification (CWE)
References
- www.dlink.com/en/security-bulletin/ (Vendor Advisory)
- www.dlink.com/ (Product)
- github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/4.md (Broken Link)
- github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/CVE-2025-6… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-60697?
- CVE-2025-60697 is a high-severity vulnerability in Dlink Dir-882, classified under Command Injection. CVSS score: 7.3/10. Published 2025-11-13.
- How severe is CVE-2025-60697?
- High severity. CVSS v3 base score is 7.3 out of 10.