Description
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.
Published: 2025-11-13
Score: 6.5 Medium
EPSS: 3.5% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Tue, 03 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77
CPEs cpe:2.3:h:dlink:dir-878:a1:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dir-878
Dlink dir-878 Firmware
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Description An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. NOTE: this is disputed by third parties because /cgi-bin/prog.cgi does not exist and because "directly concatenated into shell commands" occurs after adequate input vaidation. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Tue, 03 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
Description An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. NOTE: this is disputed by third parties because /cgi-bin/prog.cgi does not exist and because "directly concatenated into shell commands" occurs after adequate input vaidation.

Mon, 17 Nov 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dir-878
Dlink dir-878 Firmware
CPEs cpe:2.3:h:dlink:dir-878:a1:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dir-878
Dlink dir-878 Firmware

Fri, 14 Nov 2025 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 14 Nov 2025 09:30:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dir-878
D-link dir-878 Firmware
Vendors & Products D-link
D-link dir-878
D-link dir-878 Firmware

Thu, 13 Nov 2025 19:00:00 +0000

Type Values Removed Values Added
Description An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.
References

Subscriptions

D-link Dir-878 Dir-878 Firmware
Dlink Dir-878 Dir-878 Firmware
cve-icon MITRE

Status: REJECTED

Assigner: mitre

Published:

Updated: 2026-11-03T19:16:56.608Z

Reserved: 2025-09-26T00:00:00.000Z

Link: CVE-2025-60676

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2025-11-13T19:15:48.560

Modified: 2026-11-03T20:17:39.693

Link: CVE-2025-60676

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-11-14T09:29:08Z

Weaknesses