CVE-2025-60697

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` function in `prog.cgi` stores user-supplied DDNS parameters (`ServerAddress` and `Hostname`) in NVRAM via `nvram_safe_set`. These values are later retrieved in the `start_DDNS_ipv4` function of `rc` using `nvram_safe_get` and concatenated into DDNS shell commands executed via `twsystem()` without proper sanitization. Partial string comparison is performed but is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-606987.3A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Th CVE-2025-606996.5A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `g CVE-2025-60706.5The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the outpu CVE-2025-607006.5A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binar CVE-2025-607016.5A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Th CVE-2025-607026.5A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The CVE-2025-607037.8Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.CVE-2025-607047.5Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.CVE-2025-607057.8Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.CVE-2025-607065.5Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.CVE-2025-607077.8Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally.CVE-2025-607086.5Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.