Read the docs
TI-2025-37749 Aliases CVE-2025-60672GHSA-4h72-3qcj-43q9

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router…

Priority HIGH 70CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.

Summary

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDynamicDNSSettings' functionality, where the 'ServerAddress' and 'Hostname' parameters in prog.cgi are stored in NVRAM and later used by rc to construct system commands executed via twsystem(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03627 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:*1.01b04VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dir-878:a1:*:*:*:*:*:*:*a1Running onD-Link Japan K.K.
  • cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:* Versions 1.01b04 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dir-878:a1:*:*:*:*:*:*:* Versions a1 Running on ·D-Link Japan K.K.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-60672
  2. 2026-10-03 Alias added: GHSA-4h72-3qcj-43q9

References

Exploit 1

Advisory 1

Other 1

  • TI-2023-12376 D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_48d630… CVSS 3.1CRITICAL 9.8
  • TI-2020-07118 Incorrect comparison in D-Link Multiple Routers CVSS 3.1HIGH 8.8
  • TI-2020-07117 Improper authentication in D-Link Multiple Routers CVSS 3.1HIGH 8.8
  • TI-2025-37750 An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router… CVSS 3.1MEDIUM 6.5
  • TI-2025-00398 D-Link DIR-878 HTTP POST Request dllog.cgi information disclosure CVSS 4.0MEDIUM 6.9
  • TI-2024-32450 D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command… CVSS 3.1HIGH 8.0
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences