# CVE-2025-60698: A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi`…

Source: https://junglewise.ai/threats/cve-2025-60698-a-command-injection-vulnerability-exists-in-the-d-link-dir-882  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13  
License: CC BY 4.0 with a link back

CVE-2025-60698 · Severity: high · CVSS 7.3 · Published 2025-11-13

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_432F60` function in `prog.cgi` stores user-supplied `SetSysLogSettings/IPAddress` values in NVRAM via `nvram_safe_set("SysLogRemote_IPAddress", ...)`. These values are later retrieved in the `sub_448DCC` function of `rc` using `nvram_safe_get` and concatenated into a shell command executed via `twsystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

Technologies: [Dlink Dir-882](https://junglewise.ai/threats/technologies/dlink-dir-882), [Dlink Dir-882 Firmware](https://junglewise.ai/threats/technologies/dir-882-firmware). Vendors: [Dlink](https://junglewise.ai/threats/vendors/dlink).

## Quick answers

**Is CVE-2025-60698 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60698 being exploited in the wild.

**How severe is CVE-2025-60698?** High severity, with a CVSS score of 7.3, published 13 November 2025.

**Which products and versions are affected?** Dlink Dir-882, Dlink Dir-882 Firmware. The advisory does not name versions.

**Is there a fix for CVE-2025-60698?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-60698?** Check whether you run Dlink Dir-882 or Dlink Dir-882 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Dlink Dir-882
- Dlink Dir-882 Firmware

## Related threats

- [A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the…](https://junglewise.ai/threats/cve-2026-5844-a-vulnerability-was-found-in-d-link-dir-882-1-01b02-impacted-is)
- [A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi`…](https://junglewise.ai/threats/cve-2025-60701-a-command-injection-vulnerability-exists-in-the-d-link-dir-882)
- [A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi`…](https://junglewise.ai/threats/cve-2025-60700-a-command-injection-vulnerability-exists-in-the-d-link-dir-882)
- [A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi`…](https://junglewise.ai/threats/cve-2025-60697-a-command-injection-vulnerability-exists-in-the-d-link-dir-882)