CVE-2025-60700

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binaries. The `sub_4455BC` function in `prog.cgi` stores user-supplied `SetDMZSettings/IPAddress` values in NVRAM via `nvram_safe_set("dmz_ipaddr", ...)`. These values are later retrieved in the `DMZ_run` function of `librcm.so` using `nvram_safe_get` and concatenated into `iptables` shell commands executed via `twsystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 13, 2025
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-607016.5A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. ThCVE-2025-607026.5A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The CVE-2025-607037.8Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.CVE-2025-607047.5Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.CVE-2025-607057.8Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.CVE-2025-607065.5Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.CVE-2025-607077.8Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally.CVE-2025-607086.5Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.CVE-2025-607097.8Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CVE-2025-60715.3Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to dCVE-2025-607107.8Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate prCVE-2025-607116.3Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2025-60700: Medium severity, CVSS 6.5 | Vulnix