A command injection vulnerability (CVE-2025-60697) exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02. The flaw occurs in the handling of DDNS parameters in the router's web interface, where user-supplied input is stored in NVRAM and later used unsafely in shell commands. This allows an unauthenticated remote attacker to execute arbitrary commands on the device via crafted HTTP requests.