Executive brief
A security vulnerability exists in the D-Link DIR-823G router, a device used to provide wireless internet connectivity for homes and small offices. An attacker who gains access to the device's file system can execute unauthorized commands, potentially leading to full control over the router's operations. This could allow an intruder to disrupt internet service or intercept network traffic.
Technical details
A command injection vulnerability exists in the D-Link DIR-823G router firmware (specifically version DIR823G_V1.0.2B05_20181207.bin) within the 'timelycheck' and 'sysconf' binaries. The issue stems from improper validation of the '/var/system/linux_vlan_reinit' file content; the binaries only check for 'eth' or 'wlan' prefixes before passing the data to 'vsnprintf' and subsequently 'system()'. An attacker with the ability to write to this file—either through local access or by leveraging another vulnerability—can inject shell commands (e.g., using semicolons) to achieve arbitrary code execution with the privileges of the affected binaries. As of the advisory date, users should ensure their devices are not exposed to untrusted users and check for firmware updates from D-Link.
Affected products
- D-Link DIR-823G DIR823G_V1.0.2B05_20181207.bin
Timeline
- 2025-11-13: advisory: Initial disclosure of CVE-2025-60671