CVE-2025-60701
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
A command injection vulnerability exists in the D-Link DIR-882 router firmware DIR882A1_FW102B02 within the prog.cgi and rc binaries. User-supplied email configuration parameters are stored in NVRAM and later concatenated into shell commands without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.
Risk Assessment
An unauthenticated attacker could take control of the device, execute arbitrary commands, and potentially gain access to the internal network or conduct further attacks.
Recommendation
Update the D-Link DIR-882 router firmware to the latest version if a patch is available. Until then, restrict access to the router's web interface to trusted networks.
Other vulnerabilities in D-Link DIR-882
See all- CVE-2026-90881Medium
A vulnerability was detected in D-Link DIR-882 up to version 20260814. It affects the main function in /HNAP1/dllog.cgi of the CGI Binary component. Manipulation leads to information disclosure. The attack can be launched remotely, and the exploit is public.
- CVE-2025-60700Medium
A command injection vulnerability exists in the D-Link DIR-882 router firmware DIR882A1_FW102B02 within the prog.cgi and librcm.so binaries. The SetDMZSettings/IPAddress value is stored in NVRAM and later concatenated into iptables shell commands without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.
Original NVD description (English source)
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_433188` function in `prog.cgi` stores user-supplied email configuration parameters (`EmailFrom`, `EmailTo`, `SMTPServerAddress`, `SMTPServerPort`, `AccountName`) in NVRAM via `nvram_safe_set`. These values are later retrieved in the `sub_448FDC` function of `rc` using `nvram_safe_get` and concatenated into shell commands executed via `twsystem()` without sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS