CVE-2025-60697 Command injection in n/a
Unauthenticated remote attackers can execute arbitrary commands on D-Link DIR-882 routers via unsanitized DDNS parameters in prog.cgi and rc binaries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-60697?
CVE-2025-60697 is a high-severity command injection vulnerability in n/a, published on 13 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` function in `prog.cgi` stores user-supplied DDNS parameters (`ServerAddress` and `Hostname`) in NVRAM via `nvram_safe_set`. These values are later retrieved in the `start_DDNS_ipv4` function of `rc` using `nvram_safe_get` and concatenated into DDNS shell commands executed via `twsystem()` without proper sanitization. Partial string comparison is performed but is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
Weakness: CWE-77
Which versions are affected by CVE-2025-60697?
It affects 1 product.
Products include Dlink Dir-882 Firmware.
How do I fix CVE-2025-60697?
No fix has been published for CVE-2025-60697 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-60697 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-60697 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j2hm-6346-j7hx.