Dashboard / CVE-2025-60672

CVE-2025-60672

MEDIUM
MEDIUM Priority: 0.24 BB Relevance: 74/100
Published: 2025-11-13 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: None

Description

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDynamicDNSSettings' functionality, where the 'ServerAddress' and 'Hostname' parameters in prog.cgi are stored in NVRAM and later used by rc to construct system commands executed via twsystem(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
dlink dir-878_firmware 1.01b04

References & Advisories (3)

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

3.63%
Raw Score 0.036270
Percentile 89.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.03627
2026-11-12
0.03627
2026-11-10
0.03627
2026-11-09
0.03627
2026-11-08
0.03627
2026-11-07
0.03627
2026-11-06
0.03627
2026-11-05
0.03627

Intelligence Sources

nvd ref →

External Links