CVE-2025-60698 — HIGH (7.3)

Vulnerability Description

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_432F60` function in `prog.cgi` stores user-supplied `SetSysLogSettings/IPAddress` values in NVRAM via `nvram_safe_set("SysLogRemote_IPAddress", ...)`. These values are later retrieved in the `sub_448DCC` function of `rc` using `nvram_safe_get` and concatenated into a shell command executed via `twsystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

CVSS Score

7.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Dlink	Dir-882 Firmware	1.02b02
Dlink	Dir-882	a1

Related Weaknesses (CWE)

CWE-77

References

https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/2.mBroken Link
https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/CVEExploitThird Party Advisory
https://www.dlink.com/Product
https://www.dlink.com/en/security-bulletin/Vendor Advisory

FAQ

What is CVE-2025-60698?

CVE-2025-60698 is a vulnerability with a CVSS score of 7.3 (HIGH). A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_432F60` function in `prog.cgi` stores user-supplied `...

How severe is CVE-2025-60698?

CVE-2025-60698 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-60698?

Check the references section above for vendor advisories and patch information. Affected products include: Dlink Dir-882 Firmware, Dlink Dir-882.