A command injection vulnerability (CVE-2025-60701) exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02. The flaw occurs in the prog.cgi and rc binaries where user-supplied email configuration parameters are stored in NVRAM and later used unsanitized in shell commands. This allows an unauthenticated remote attacker to execute arbitrary commands via specially crafted HTTP requests to the router's web interface. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.