Is CVE-2025-60675 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60675 being exploited in the wild.

How severe is CVE-2025-60675?

Medium severity, with a CVSS score of 5.4, published 13 November 2025.

Which products and versions are affected?

D-Link DIR-823G DIR823G_V1.0.2B05_20181207.bin.

Is there a fix for CVE-2025-60675?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60675 attacked?

It is attacked over the network or with local access, in a network appliance.

Am I affected by CVE-2025-60675?

Check whether you run Dlink Dir-823g Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60675: D-Link DIR-823G command injection in timelycheck and sysconf

CVE-2025-60675 · Severity: medium · CVSS 5.4 · Published 2025-11-13

A security vulnerability exists in the D-Link DIR-823G, a wireless router used for home and small office internet connectivity. The device fails to properly check data within its internal configuration files, which could allow an attacker who has gained a foothold on the device to take full control of the system. This could lead to the interception of network traffic, unauthorized access to connected devices, or a complete disruption of internet services.

Vendors: Dlink.

Quick answers

Is CVE-2025-60675 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60675 being exploited in the wild.
How severe is CVE-2025-60675?: Medium severity, with a CVSS score of 5.4, published 13 November 2025.
Which products and versions are affected?: D-Link DIR-823G DIR823G_V1.0.2B05_20181207.bin.
Is there a fix for CVE-2025-60675?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60675 attacked?: It is attacked over the network or with local access, in a network appliance.
Am I affected by CVE-2025-60675?: Check whether you run Dlink Dir-823g Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the 'timelycheck' and 'sysconf' binaries of the D-Link DIR-823G router (firmware version DIR823G_V1.0.2B05_20181207.bin). The issue stems from the improper sanitization of fields parsed from the '/tmp/new_qos.rule' configuration file using sscanf(). These unsanitized strings are subsequently concatenated into iptables command strings and executed via the system() function. An attacker who can modify this temporary file—either through local access or by exploiting other vulnerabilities that allow filesystem writes—can achieve arbitrary code execution with the privileges of the affected binaries. While the CVSS vector suggests a network attack vector with low privileges, the exploit specifically requires the ability to write to the /tmp directory.

Affected products

D-Link DIR-823G DIR823G_V1.0.2B05_20181207.bin

Timeline

2025-11-13: advisory: Initial NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.