CVE-2025-60698: Command Injection

Published Nov 13, 2025

Updated

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1FW102B02 within the prog.cgi and rc binaries. The sub432F60 function in prog.cgi stores user-supplied SetSysLogSettings/IPAddress values in NVRAM via nvramsafeset("SysLogRemoteIPAddress", ...). These values are later retrieved in the sub448DCC function of rc using nvramsafeget and concatenated into a shell command executed via twsystem() without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

Affected Software

3 affected components

D-Link DIR-882 Router

All of the following

Dlink Dir-882 Firmware=1.02b02

Dlink Dir-882=a1

Event History

Nov 13, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60698?

CVE-2025-60698 is classified as a high severity command injection vulnerability in the D-Link DIR-882 Router.

How do I fix CVE-2025-60698?

To mitigate CVE-2025-60698, update the D-Link DIR-882 Router firmware to the latest version provided by D-Link.

What impact does CVE-2025-60698 have?

CVE-2025-60698 allows attackers to execute arbitrary commands on the affected D-Link DIR-882 Router.

Which devices are affected by CVE-2025-60698?

CVE-2025-60698 affects the D-Link DIR-882 Router with the firmware version DIR882A1_FW102B02.

Is CVE-2025-60698 remotely exploitable?

Yes, CVE-2025-60698 can be exploited remotely due to the command injection vulnerability in the router's firmware.