CVE-2025-60698 Command injection in n/a

High 7.3 Published 13 Nov 2025 Updated 13 Nov 2025

Unauthenticated remote attackers can execute arbitrary commands on D-Link DIR-882 routers via unsanitized input in the web interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-60698?

CVE-2025-60698 is a high-severity command injection vulnerability in n/a, published on 13 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_432F60` function in `prog.cgi` stores user-supplied `SetSysLogSettings/IPAddress` values in NVRAM via `nvram_safe_set("SysLogRemote_IPAddress", ...)`. These values are later retrieved in the `sub_448DCC` function of `rc` using `nvram_safe_get` and concatenated into a shell command executed via `twsystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

Weakness: CWE-77

Which versions are affected by CVE-2025-60698?

It affects 1 product.

Products include Dlink Dir-882 Firmware.

How do I fix CVE-2025-60698?

No fix has been published for CVE-2025-60698 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-60698 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-60698 exists.

Sources

Also known as GHSA-c4h7-mp9w-g2wr.