CVE-2025-60698

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries

High · published November 13, 2025

CVSS v3.1
7.3
EPSS
4%
Percentile
90.3
In the wild
Unconfirmed
What it is

🚨 A crafty attacker can remotely execute commands on your D-Link DIR-882 Router with just a few specially crafted HTTP requests! ⚡ Think of it like a hotel receptionist who writes down guests' requests for room service but also hands over the master key without verifying the identity — anyone could stroll in and make themselves at home! This vulnerability could lead to complete control over your router, allowing an attacker to modify settings, intercept traffic, or even launch attacks on other devices connected to your network. The potential fallout could be absolutely devastating for your privacy and security!

Put simply

Think of it like a hotel receptionist who writes down guests' requests for room service but also hands over the master key without verifying the identity — anyone could stroll in and make themselves at home! The command injection flaw in the D-Link DIR-882 Router occurs when user-provided IP address values are unsanitized and executed as shell commands, enabling unauthorized command execution via the router's web interface.

What to do

This vulnerability could lead to complete control over your router, allowing an attacker to modify settings, intercept traffic, or even launch attacks on other devices connected to your network. The potential fallout could be absolutely devastating for your privacy and security! Update your D-Link DIR-882 Router firmware to the latest version (DIR882A1_FW102B03 or later) immediately. Additionally, consider implementing network access controls and monitor your router's logs for any suspicious activity. 🛡️ You've got this! With the right updates and precautions, you'll secure your router and keep those cyber baddies at bay! 💪✨

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.03929 · 90.3th percentile
Published
2025-11-13T00:00Z
EPSS history
Timeline
  • 13 NOV 00:00Z
    A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries
    cvelistv5