Stack Buffer Overflow in D-Link DIR-878A1 Router Firmware

CVE-2025-60674

What is CVE-2025-60674?

A stack buffer overflow vulnerability is present in the D-Link DIR-878A1 router due to improper handling of the 'Serial Number' field from USB devices. The rc binary's USB storage handling module reads this field into a 64-byte stack buffer using sscanf, while fgets can read up to 127 bytes, leading to a potential stack overflow condition. An attacker with physical access to the device or control over a connected USB device could exploit this vulnerability to execute arbitrary code on the router, posing significant security risks.

References