Command Injection Vulnerability in D-Link DIR-882 Router Firmware
CVE-2025-60698

7.3HIGH

Key Information:

Vendor

D-Link
Status
DIR-882 Router
Vendor
CVE Published:
13 November 2025

What is CVE-2025-60698?

A command injection vulnerability has been identified in the firmware of the D-Link DIR-882 Router. The issue arises within the prog.cgi and rc binaries, specifically in the sub_432F60 function where user-provided values for SetSysLogSettings/IPAddress are stored in NVRAM. These values are later accessed and concatenated into a shell command in the sub_448DCC function, executed unsanitized through twsystem(). This flaw allows an unauthenticated remote attacker to exploit the device via crafted HTTP requests to the router's web interface, enabling command execution with potential malicious consequences.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.dlink.com/en/security-bulletin/
https://www.dlink.com/
https://github.com/yifan20020708/SGTaint-0-day/blob/main/...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.