# CVE-2025-60674: D-Link DIR-878A1 stack buffer overflow in rc USB storage handling

Source: https://junglewise.ai/threats/cve-2025-60674-d-link-dir-878a1-stack-buffer-overflow-in-rc-usb-storage-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-60674 · Severity: medium · CVSS 6.8 · Published 2025-11-13

A security vulnerability exists in the D-Link DIR-878A1 router, a device used to provide internet connectivity in homes and small offices. The flaw is located in how the router processes information from connected USB storage devices. An attacker with physical access to the router could use a specially crafted USB device to crash the system or potentially take full control of the equipment, leading to unauthorized access to the network or data interception.

Technologies: [Dlink Dir-878](https://junglewise.ai/threats/technologies/dir-878), [Dlink Dir-878 Firmware](https://junglewise.ai/threats/technologies/dir-878-firmware). Vendors: [Dlink](https://junglewise.ai/threats/vendors/dlink).

## Quick answers

**Is CVE-2025-60674 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60674 being exploited in the wild.

**How severe is CVE-2025-60674?** Medium severity, with a CVSS score of 6.8, published 13 November 2025.

**Which products and versions are affected?** D-Link DIR-878A1 FW101B04.bin.

**Is there a fix for CVE-2025-60674?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-60674 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2025-60674?** Check whether you run Dlink Dir-878 or Dlink Dir-878 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the 'rc' binary of D-Link DIR-878A1 firmware version FW101B04.bin. The vulnerability is located in the USB storage handling module, specifically within a function that processes device information from /proc/scsi/usb-storage/. The 'fgets' function reads up to 127 bytes from the device's "Serial Number" field into a temporary buffer, which is then passed to 'sscanf' and copied into a fixed 64-byte stack buffer (v17). Because 'sscanf' does not perform bounds checking, providing a serial number longer than 64 bytes results in a stack overflow. An attacker with physical access or the ability to emulate a USB device can exploit this to overwrite the return address and achieve arbitrary code execution.

## Affected products

- D-Link DIR-878A1 FW101B04.bin

## Timeline

- 2025-11-13: disclosed: Initial disclosure via MITRE/NVD
- 2025-11-13: advisory

## References

- [https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60674.md](https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60674.md)
- [https://www.dlink.com/en](https://www.dlink.com/en)
- [https://www.dlink.com/en/security-bulletin/](https://www.dlink.com/en/security-bulletin/)

## Related threats

- [D-Link DIR-878 A1 command injection in prog.cgi](https://junglewise.ai/threats/cve-2025-60676-d-link-dir-878-a1-command-injection-in-prog-cgi)
- [D-Link DIR-878 A1 command injection in SetDMZSettings](https://junglewise.ai/threats/cve-2025-60673-d-link-dir-878-a1-command-injection-in-setdmzsettings)
- [D-Link DIR-878A1 command injection in SetDynamicDNSSettings](https://junglewise.ai/threats/cve-2025-60672-d-link-dir-878a1-command-injection-in-setdynamicdnssettings)