CVE-2025-60697: A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi`…
CVE-2025-60697 · Severity: high · CVSS 7.3 · Published 2025-11-13
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` function in `prog.cgi` stores user-supplied DDNS parameters (`ServerAddress` and `Hostname`) in NVRAM via `nvram_safe_set`. These values are later retrieved in the `start_DDNS_ipv4` function of `rc` using `nvram_safe_get` and concatenated into DDNS shell commands executed via `twsystem()` without proper sanitization. Partial string comparison is performed but is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
No. Junglewise Threat Intelligence has no report of CVE-2025-60697 being exploited in the wild.
How severe is CVE-2025-60697?
High severity, with a CVSS score of 7.3, published 13 November 2025.
Which products and versions are affected?
Dlink Dir-882, Dlink Dir-882 Firmware. The advisory does not name versions.
Is there a fix for CVE-2025-60697?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-60697?
Check whether you run Dlink Dir-882 or Dlink Dir-882 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.