CVE-2025-60672 is a command injection vulnerability identified in the D-Link DIR-878A1 router firmware version FW101B04.bin. The flaw resides in the 'SetDynamicDNSSettings' functionality exposed via the prog.cgi interface. Specifically, the parameters 'ServerAddress' and 'Hostname' are accepted from HTTP requests and stored directly into the router's NVRAM without proper sanitization or validation. These stored values are later incorporated into system commands executed by the router's rc script using the twsystem() function, which executes shell commands. Because the input is not sanitized, an attacker can inject arbitrary shell commands through these parameters. The vulnerability is exploitable remotely over the network without requiring any authentication or user interaction, making it particularly dangerous. Successful exploitation allows an attacker to execute arbitrary commands on the router with root privileges, potentially leading to device compromise, interception or manipulation of network traffic, and pivoting into internal networks. The CVSS 3.1 base score is 6.5, reflecting a medium severity level due to the lack of impact on availability and the moderate impact on confidentiality and integrity. No patches or exploits are currently publicly known, but the vulnerability poses a significant risk given the ease of exploitation and the critical role of routers in network infrastructure.

For European organizations, this vulnerability poses a significant risk to network security and data confidentiality. Compromise of the D-Link DIR-878A1 routers could allow attackers to intercept, modify, or redirect network traffic, leading to data breaches or espionage. The ability to execute arbitrary commands could enable attackers to install persistent malware, create backdoors, or disrupt network operations. Since the exploit requires no authentication and can be triggered remotely, exposed routers with remote management enabled are particularly vulnerable. This could impact enterprises, ISPs, and home users relying on this router model. The confidentiality and integrity of sensitive communications and internal networks could be compromised, potentially affecting compliance with GDPR and other data protection regulations. The lack of availability impact reduces the risk of denial-of-service but does not diminish the threat to data security and network trustworthiness.

1. Immediately check for and apply any official firmware updates from D-Link addressing this vulnerability. 2. If no patch is available, disable remote management interfaces (e.g., WAN-side HTTP/HTTPS access) to prevent external exploitation. 3. Restrict access to the router’s management interface to trusted internal networks only. 4. Implement network segmentation to isolate critical systems from potentially compromised routers. 5. Monitor network traffic for unusual patterns that may indicate exploitation attempts. 6. Replace affected devices with models confirmed to be free of this vulnerability if patching is not feasible. 7. Educate users and administrators about the risks of exposing router management interfaces to the internet. 8. Employ intrusion detection/prevention systems to detect command injection attempts targeting routers. 9. Regularly audit router configurations to ensure no unauthorized changes have been made. 10. Consider using alternative DNS update mechanisms that do not rely on vulnerable router functions.