CVE-2025-60697: Command Injection

Published Nov 13, 2025

Updated

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1FW102B02 within the prog.cgi and rc binaries. The sub4438A4 function in prog.cgi stores user-supplied DDNS parameters (ServerAddress and Hostname) in NVRAM via nvramsafeset. These values are later retrieved in the startDDNSipv4 function of rc using nvramsafeget and concatenated into DDNS shell commands executed via twsystem() without proper sanitization. Partial string comparison is performed but is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

Affected Software

3 affected components

D-Link DIR-882 Router

All of the following

Dlink Dir-882 Firmware=1.02b02

Dlink Dir-882=a1

Event History

Nov 13, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60697?

CVE-2025-60697 is classified as a critical command injection vulnerability.

How do I fix CVE-2025-60697?

To mitigate CVE-2025-60697, users should update their D-Link DIR-882 Router firmware to the latest version provided by D-Link.

What is the impact of CVE-2025-60697?

CVE-2025-60697 allows an attacker to execute arbitrary commands on the affected D-Link DIR-882 Router.

Which devices are affected by CVE-2025-60697?

CVE-2025-60697 specifically affects the D-Link DIR-882 Router with firmware DIR882A1_FW102B02.

How can I identify if my D-Link DIR-882 Router is vulnerable to CVE-2025-60697?

You can check the firmware version of your D-Link DIR-882 Router and confirm if it matches DIR882A1_FW102B02 to determine vulnerability to CVE-2025-60697.