CVE-2025-60697

{
  "id": "CVE-2025-60697",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-13T18:15:53.753",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` function in `prog.cgi` stores user-supplied DDNS parameters (`ServerAddress` and `Hostname`) in NVRAM via `nvram_safe_set`. These values are later retrieved in the `start_DDNS_ipv4` function of `rc` using `nvram_safe_get` and concatenated into DDNS shell commands executed via `twsystem()` without proper sanitization. Partial string comparison is performed but is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos existe en el firmware del router D-Link DIR-882 DIR882A1_FW102B02 dentro de los binarios ’prog.cgi’ y ’rc’. La función ’sub_4438A4’ en ’prog.cgi’ almacena parámetros DDNS proporcionados por el usuario (’ServerAddress’ y ’Hostname’) en NVRAM a través de ’nvram_safe_set’. Estos valores son recuperados posteriormente en la función ’start_DDNS_ipv4’ de ’rc’ usando ’nvram_safe_get’ y concatenados en comandos de shell DDNS ejecutados a través de ’twsystem()’ sin una sanitización adecuada. Se realiza una comparación parcial de cadenas, pero es insuficiente para prevenir la inyección de comandos. Un atacante remoto no autenticado puede explotar esta vulnerabilidad para ejecutar comandos arbitrarios en el dispositivo a través de solicitudes HTTP especialmente diseñadas a la interfaz web del router."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-13T20:08:07.957105Z",
          "id": "CVE-2025-60697",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dlink:dir-882_firmware:1.02b02:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D969AE6-54B1-4A8C-8A2D-8C8B0C3EF9B2"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:dlink:dir-882:a1:*:*:*:*:*:*:*",
              "matchCriteriaId": "90575122-CE47-42E5-BCE3-6444599B16B3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/4.md",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/CVE-2025-60697.md",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.dlink.com/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.dlink.com/en/security-bulletin/",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}