An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The flaw is in the 'SetDMZSettings' functionality where the 'IPAddress' parameter is improperly handled, allowing remote attackers to execute arbitrary commands without authentication by sending a crafted HTTP request.