CVE-2025-60671
MEDIUM
MEDIUM
Priority: 0.08
BB Relevance:
61/100
Published: 2025-11-13
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
Low
I:
Low
A:
None
Description
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit file. The vulnerability occurs because content read from this file is only partially validated for a prefix and then formatted using vsnprintf() before being executed with system(), allowing an attacker with write access to /var/system/linux_vlan_reinit to execute arbitrary commands on the device.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-823g_firmware | 1.0.2b05_20181207 |
References & Advisories (3)
Vendor Advisory
Product
Exploit
Third Party Advisory