This vulnerability arises from improper input handling in the 'SetNetworkSettings' function of the D-Link DIR-878A1 router firmware FW101B04.bin. Specifically, the IPAddress and SubnetMask parameters are directly concatenated into shell commands executed via system(), enabling unauthenticated remote attackers to perform command injection by crafting malicious HTTP requests to prog.cgi. The vulnerability is identified as CWE-77 (Improper Neutralization of Special Elements used in a Command). No known exploits are reported in the wild, and no vendor patch or advisory has been provided as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected router, potentially leading to partial compromise of the device's confidentiality and integrity. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact. This could enable attackers to manipulate device settings or gain further access within the network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should consider restricting access to the router's management interface from untrusted networks and monitor for unusual activity. Avoid exposing the device's management interface directly to the internet.