Executive brief
A security vulnerability exists in the D-Link DIR-878 A1 router, a device used to provide wireless internet connectivity for homes and small offices. An unauthorized person can remotely send a specially crafted request to the router to take control of the device and execute their own commands. This could allow an attacker to disrupt internet service, intercept network traffic, or gain a foothold within the local network.
Technical details
An unauthenticated command injection vulnerability exists in the 'SetNetworkSettings' handler within the prog.cgi component of D-Link DIR-878 A1 firmware version FW101B04.bin. The vulnerability stems from the improper sanitization of the 'IPAddress' and 'SubnetMask' parameters, which are retrieved via webGetVarString and directly concatenated into a shell command string using sprintf. This string is subsequently executed with root privileges via the system() function. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP POST request containing shell metacharacters (e.g., semicolons) within the XML payload. Successful exploitation results in arbitrary command execution on the underlying Linux operating system.
Affected products
- D-Link DIR-878 A1 FW101B04.bin
Timeline
- 2025-11-13: disclosed
- 2025-11-13: advisory