# CVE-2025-60672: D-Link DIR-878A1 command injection in SetDynamicDNSSettings

Source: https://junglewise.ai/threats/cve-2025-60672-d-link-dir-878a1-command-injection-in-setdynamicdnssettings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-60672 · Severity: medium · CVSS 6.5 · Published 2025-11-13

A security vulnerability has been identified in the D-Link DIR-878A1 router, a device used to provide internet connectivity for homes and small offices. An attacker can remotely send a specially crafted request to the router's management interface to take control of the device without needing a password. This could allow an unauthorized user to monitor network traffic, disrupt internet service, or use the router as a foothold to attack other devices on the local network.

Technologies: [Dlink Dir-878](https://junglewise.ai/threats/technologies/dir-878), [Dlink Dir-878 Firmware](https://junglewise.ai/threats/technologies/dir-878-firmware). Vendors: [Dlink](https://junglewise.ai/threats/vendors/dlink).

## Quick answers

**Is CVE-2025-60672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60672 being exploited in the wild.

**How severe is CVE-2025-60672?** Medium severity, with a CVSS score of 6.5, published 13 November 2025.

**Which products and versions are affected?** D-Link DIR-878A1 FW101B04.bin.

**Is there a fix for CVE-2025-60672?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-60672 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-60672?** Check whether you run Dlink Dir-878 or Dlink Dir-878 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware (specifically version FW101B04.bin). The flaw is located in the 'SetDynamicDNSSettings' functionality within 'prog.cgi'. User-supplied input for the 'ServerAddress' and 'Hostname' parameters is stored in NVRAM without sufficient sanitization. These values are subsequently retrieved by the 'rc' binary and used to construct system command strings passed to the 'twsystem()' function (a wrapper for system()). A remote, unauthenticated attacker can exploit this by sending a crafted HTTP POST request to 'prog.cgi', leading to arbitrary code execution with elevated privileges. A Proof of Concept (PoC) has been publicly disclosed.

## Affected products

- D-Link DIR-878A1 FW101B04.bin

## Timeline

- 2025-11-13: advisory: Initial NVD publication date
- 2025-11-14: other: CISA-ADP enrichment and CVSS scoring added

## References

- [https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60672.md](https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60672.md)
- [https://www.dlink.com/en](https://www.dlink.com/en)
- [https://www.dlink.com/en/security-bulletin/](https://www.dlink.com/en/security-bulletin/)

## Related threats

- [D-Link DIR-878 A1 command injection in prog.cgi](https://junglewise.ai/threats/cve-2025-60676-d-link-dir-878-a1-command-injection-in-prog-cgi)
- [D-Link DIR-878A1 stack buffer overflow in rc USB storage handling](https://junglewise.ai/threats/cve-2025-60674-d-link-dir-878a1-stack-buffer-overflow-in-rc-usb-storage-handling)
- [D-Link DIR-878 A1 command injection in SetDMZSettings](https://junglewise.ai/threats/cve-2025-60673-d-link-dir-878-a1-command-injection-in-setdmzsettings)