# CVE-2025-60673: D-Link DIR-878 A1 command injection in SetDMZSettings

Source: https://junglewise.ai/threats/cve-2025-60673-d-link-dir-878-a1-command-injection-in-setdmzsettings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-60673 · Severity: medium · CVSS 6.5 · Published 2025-11-13

A security vulnerability exists in the D-Link DIR-878 A1 router, a device used to provide wireless internet connectivity for homes and small offices. An attacker can exploit this flaw to take control of the router without needing a password or physical access. This could allow an unauthorized user to disrupt internet service, intercept network traffic, or use the device as a foothold for further attacks on the local network.

Technologies: [Dlink Dir-878](https://junglewise.ai/threats/technologies/dir-878), [Dlink Dir-878 Firmware](https://junglewise.ai/threats/technologies/dir-878-firmware). Vendors: [Dlink](https://junglewise.ai/threats/vendors/dlink).

## Quick answers

**Is CVE-2025-60673 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60673 being exploited in the wild.

**How severe is CVE-2025-60673?** Medium severity, with a CVSS score of 6.5, published 13 November 2025.

**Which products and versions are affected?** D-Link DIR-878 A1 FW101B04.bin.

**Is there a fix for CVE-2025-60673?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-60673 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2025-60673?** Check whether you run Dlink Dir-878 or Dlink Dir-878 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated command injection vulnerability exists in the 'SetDMZSettings' functionality of the D-Link DIR-878 A1 router (firmware FW101B04.bin). The vulnerability stems from improper sanitization of the 'IPAddress' parameter in prog.cgi, which is stored in NVRAM as 'dmz_ipaddr'. This value is subsequently retrieved by librcm.so and used to construct iptables shell commands via snprintf() before being executed by twsystem(). A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing shell metacharacters in the IPAddress field, leading to arbitrary code execution with elevated privileges.

## Affected products

- D-Link DIR-878 A1 FW101B04.bin

## Timeline

- 2025-11-13: disclosed
- 2025-11-13: advisory

## References

- [https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60673.md](https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60673.md)
- [https://www.dlink.com/en](https://www.dlink.com/en)
- [https://www.dlink.com/en/security-bulletin/](https://www.dlink.com/en/security-bulletin/)

## Related threats

- [D-Link DIR-878 A1 command injection in prog.cgi](https://junglewise.ai/threats/cve-2025-60676-d-link-dir-878-a1-command-injection-in-prog-cgi)
- [D-Link DIR-878A1 stack buffer overflow in rc USB storage handling](https://junglewise.ai/threats/cve-2025-60674-d-link-dir-878a1-stack-buffer-overflow-in-rc-usb-storage-handling)
- [D-Link DIR-878A1 command injection in SetDynamicDNSSettings](https://junglewise.ai/threats/cve-2025-60672-d-link-dir-878a1-command-injection-in-setdynamicdnssettings)