CVE-2025-60673: D-Link DIR-878 Firmware RCE Vulnerability

CVE-2025-60673 Overview

CVE-2025-60673 is an unauthenticated command injection vulnerability in the D-Link DIR-878A1 router running firmware FW101B04.bin. The flaw resides in the SetDMZSettings functionality exposed through prog.cgi. Attackers can inject shell metacharacters through the IPAddress parameter, which is stored in Non-Volatile Random-Access Memory (NVRAM) and later interpolated into iptables commands executed by twsystem() inside librcm.so. Remote attackers can trigger arbitrary command execution on the device without authentication by sending a crafted HTTP request. The issue is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Unauthenticated remote attackers can execute arbitrary operating system commands on affected D-Link DIR-878 routers, enabling full device takeover and pivot into internal networks.

Affected Products

D-Link DIR-878 hardware revision A1
D-Link DIR-878 firmware version 1.01B04 (FW101B04.bin)
Devices deploying the vulnerable librcm.so component

Discovery Timeline

2025-11-13 - CVE-2025-60673 published to the National Vulnerability Database
2026-07-05 - Last updated in NVD database

Technical Details for CVE-2025-60673

Vulnerability Analysis

The vulnerability affects the DMZ (Demilitarized Zone) configuration handler in the router's web interface. The endpoint prog.cgi accepts a SetDMZSettings action that reads user-supplied values, including IPAddress, without validating the content against an IP address format. The value is persisted to NVRAM as a configuration entry.

Later, when the router applies firewall rules, librcm.so reads the stored IPAddress value and concatenates it into an iptables command string. The resulting command is passed to twsystem(), a wrapper around the shell that executes the string with root privileges. Shell metacharacters such as ;, |, &&, or backticks embedded in IPAddress break out of the intended command and execute attacker-controlled operations.

Because the vulnerable endpoint does not require authentication, attackers on the LAN — and any exposed WAN interfaces — can reach it directly. Command execution runs in the context of the router's system services, giving the attacker control over routing, DNS, and traffic inspection.

Root Cause

The root cause is missing input validation and unsafe command composition. The firmware trusts NVRAM values as safe strings and builds shell commands with string concatenation rather than argument arrays. twsystem() invokes a shell that interprets metacharacters, converting stored configuration into executable code.

Attack Vector

Exploitation requires network access to the router's HTTP management interface. The attacker sends an HTTP POST to prog.cgi invoking SetDMZSettings with a malicious IPAddress payload containing shell metacharacters. Once the configuration change is committed and firewall rules are reapplied, the injected command runs as root. Refer to the public proof-of-concept write-up on GitHub for request structure and payload examples.

Detection Methods for CVE-2025-60673

Indicators of Compromise

HTTP POST requests to prog.cgi containing SetDMZSettings with non-IP characters (;, |, &, `, $() in the IPAddress parameter
Unexpected outbound connections from the router to unknown hosts following DMZ configuration changes
Modified NVRAM entries for DMZ settings that contain shell syntax rather than a valid IPv4 address
New or unfamiliar processes running on the router beyond baseline system daemons

Detection Strategies

Inspect network traffic to the router's management interface for HTTP requests with malformed IPAddress values targeting SetDMZSettings
Monitor DNS and outbound connections from router IP addresses for beaconing patterns consistent with command-and-control activity
Correlate router configuration changes with the source IP that issued the request to detect unauthorized administration

Monitoring Recommendations

Log all administrative HTTP requests to consumer and small-office routers at the network perimeter
Alert on any router-originated traffic to non-standard destinations, particularly TCP/4444, TCP/1337, or unknown IPs
Baseline expected iptables rule sets and flag deviations that could indicate injected commands

How to Mitigate CVE-2025-60673

Immediate Actions Required

Disable remote WAN administration on the DIR-878 until D-Link provides a fix
Restrict LAN-side access to the router's web interface to trusted management hosts only
Reset DMZ configuration to a known-good state and inspect NVRAM entries for shell metacharacters
Rotate router administrator credentials and Wi-Fi pre-shared keys after any suspected compromise

Patch Information

D-Link had not published a firmware update addressing CVE-2025-60673 at the time of NVD publication. Monitor the D-Link Security Bulletin for updated firmware for the DIR-878 A1 hardware revision. If the device has reached end-of-support, plan replacement with a currently supported model.

Workarounds

Disable the DMZ feature entirely if it is not required for the deployment
Place the router management interface behind a segmented VLAN accessible only to administrators
Block inbound HTTP/HTTPS access to the router from the WAN interface at the upstream firewall
Replace the DIR-878 with a supported router if D-Link does not release a patched firmware image

bash

# Example: block WAN-side access to the router's management port at an upstream firewall
iptables -A FORWARD -i wan0 -p tcp --dport 80 -d <router-ip> -j DROP
iptables -A FORWARD -i wan0 -p tcp --dport 443 -d <router-ip> -j DROP