CVE-2025-60675 Command injection in n/a
An attacker with write access to a specific configuration file can execute arbitrary commands on the D-Link DIR-823G router due to unsanitized input in system calls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-60675?
CVE-2025-60675 is a medium-severity command injection vulnerability in Dlink Dir-823g Firmware, published on 13 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /tmp/new_qos.rule configuration file. The vulnerability occurs because parsed fields from the configuration file are concatenated into command strings and executed via system() without any sanitization. An attacker with write access to /tmp/new_qos.rule can execute arbitrary commands on the device.
Weakness: CWE-77
Which versions are affected by CVE-2025-60675?
It affects 1 product.
Products include Dlink Dir-823g Firmware.
How do I fix CVE-2025-60675?
No fix has been published for CVE-2025-60675 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-60675 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-60675 exists.
Other vulnerabilities in Dlink Dir-823g Firmware
Sources
Also known as GHSA-9459-cp56-77p3.