RCE in Dlink Dir-882
CVE-2025-60697
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` function in `prog.cgi` stores user-supplied DDNS parameters (`ServerAddress` and `Hostname`) in NVRAM via `nvram_safe_set`. These values are later retrieved in the `start_DDNS_ipv4` function of `rc` using `nvram_safe_get` and concatenated into DDNS shell commands executed via `twsystem()` without proper sanitization. Partial string comparison is performed but is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.038 (89.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Dlink Dir-882 — versions a1
- Dlink Dir-882_firmware — versions 1.02b02
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (Product)
- cve@mitre.org (Broken Link)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-60697?
- CVE-2025-60697 is a high-severity vulnerability in Dlink Dir-882, classified under Command Injection. CVSS score: 7.3/10. Published 2025-11-13.
- How severe is CVE-2025-60697?
- High severity. CVSS v3 base score is 7.3 out of 10.