Executive brief
A security vulnerability has been identified in the D-Link DIR-878A1 router, a device used to provide internet connectivity for homes and small offices. An attacker can remotely send a specially crafted request to the router's management interface to take control of the device without needing a password. This could allow an unauthorized user to monitor network traffic, disrupt internet service, or use the router as a foothold to attack other devices on the local network.
Technical details
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware (specifically version FW101B04.bin). The flaw is located in the 'SetDynamicDNSSettings' functionality within 'prog.cgi'. User-supplied input for the 'ServerAddress' and 'Hostname' parameters is stored in NVRAM without sufficient sanitization. These values are subsequently retrieved by the 'rc' binary and used to construct system command strings passed to the 'twsystem()' function (a wrapper for system()). A remote, unauthenticated attacker can exploit this by sending a crafted HTTP POST request to 'prog.cgi', leading to arbitrary code execution with elevated privileges. A Proof of Concept (PoC) has been publicly disclosed.
Affected products
- D-Link DIR-878A1 FW101B04.bin
Timeline
- 2025-11-13: advisory: Initial NVD publication date
- 2025-11-14: other: CISA-ADP enrichment and CVSS scoring added