Dashboard / CVE-2025-60673

CVE-2025-60673

MEDIUM
MEDIUM Priority: 0.23 BB Relevance: 74/100
Published: 2025-11-13 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: None

Description

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDMZSettings' functionality, where the 'IPAddress' parameter in prog.cgi is stored in NVRAM and later used by librcm.so to construct iptables commands executed via twsystem(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
dlink dir-878_firmware 1.01b04

References & Advisories (3)

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

3.53%
Raw Score 0.035260
Percentile 89.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.03526
2026-11-12
0.03526
2026-11-10
0.03526
2026-11-09
0.03526
2026-11-08
0.03526
2026-11-07
0.03526
2026-11-06
0.03526
2026-11-05
0.03526

Intelligence Sources

nvd ref →

External Links