Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2025-60676 on 5 November 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
CVE-2025-60676
D-Link DIR-878A1 Router Command Injection Vulnerability
Description
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
INFO
Published Date :
Nov. 13, 2025, 7:15 p.m.
Last Modified :
Nov. 5, 2026, 2:10 p.m.
Remotely Exploit :
—
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-60676 vulnerability anywhere in the article.
-
BleepingComputer
D-Link warns of new RCE flaws in end-of-life DIR-878 routers
D-Link is warning of three remotely exploitable command execution vulnerabilities that affect all models and hardware revisions of its DIR-878 router, which has reached end-of-service but is still ava ... Read more
-
CybersecurityNews
Multiple Vulnerabilities in D-Link EoL/EoS Routers Allows Remote Code Execution Attacks
Multiple critical vulnerabilities affect D-Link DIR-878 routers across all models and firmware revisions. These devices reached the end of life on January 31, 2021. They will no longer receive securit ... Read more
The following table lists the changes that have been made to the
CVE-2025-60676 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Nov. 05, 2026
Action Type Old Value New Value Added Translation Title: D-Link DIR, Description: Existe una vulnerabilidad de inyección de comandos no autenticada en el firmware FW101B04.bin del router D-Link DIR-878A1. La vulnerabilidad ocurre en la funcionalidad ’SetNetworkSettings’ de prog.cgi, donde los parámetros ’IPAddress’ y ’SubnetMask’ se concatenan directamente en comandos de shell ejecutados a través de system(). Un atacante puede explotar esta vulnerabilidad de forma remota sin autenticación enviando una solicitud HTTP especialmente diseñada, lo que lleva a la ejecución arbitraria de comandos en el dispositivo. -
CVE Modified by [email protected]
Nov. 03, 2026
Action Type Old Value New Value Removed SSVC {'id': 'CVE-2025-60676', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-11-14T16:27:16.040867Z'} Removed Tag MITRE: disputed Changed Description An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. NOTE: this is disputed by third parties because /cgi-bin/prog.cgi does not exist and because "directly concatenated into shell commands" occurs after adequate input vaidation. Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Removed CVSS V3.1 CISA-ADP: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Removed CWE CISA-ADP: CWE-77 Removed CPE Configuration AND OR *cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:* OR cpe:2.3:h:dlink:dir-878:a1:*:*:*:*:*:*:* Added Affected Affected value removed. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/60xxx/CVE-2025-60676.json">CVE-2025-60676</a> Removed Reference MITRE: https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md Removed Reference MITRE: https://www.dlink.com/en Removed Reference MITRE: https://www.dlink.com/en/security-bulletin/ Removed Reference Type MITRE: https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md Types: Exploit, Third Party Advisory Removed Reference Type MITRE: https://www.dlink.com/en Types: Product Removed Reference Type MITRE: https://www.dlink.com/en/security-bulletin/ Types: Vendor Advisory -
CVE Rejected by [email protected]
Nov. 03, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Nov. 03, 2026
Action Type Old Value New Value Added Tag disputed Changed Description An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. NOTE: this is disputed by third parties because /cgi-bin/prog.cgi does not exist and because "directly concatenated into shell commands" occurs after adequate input vaidation. Added Reference https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md Added Reference https://www.dlink.com/en Added Reference https://www.dlink.com/en/security-bulletin/ Removed Reference https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md Removed Reference https://www.dlink.com/en Removed Reference https://www.dlink.com/en/security-bulletin/ Removed Reference Type https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md Types: Exploit, Third Party Advisory Removed Reference Type https://www.dlink.com/en Types: Product Removed Reference Type https://www.dlink.com/en/security-bulletin/ Types: Vendor Advisory -
CVE Modified by [email protected]
Jul. 05, 2026
Action Type Old Value New Value Removed Reference http://d-link.com Removed Reference Type http://d-link.com Types: Product -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-60676', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-11-14T16:27:16.040867Z'} -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'n/a', 'product': 'n/a', 'versions': [{'status': 'affected', 'version': 'n/a'}]}] -
Initial Analysis by [email protected]
Nov. 17, 2025
Action Type Old Value New Value Added CPE Configuration AND OR *cpe:2.3:o:dlink:dir-878_firmware:1.01b04:*:*:*:*:*:*:* OR cpe:2.3:h:dlink:dir-878:a1:*:*:*:*:*:*:* Added Reference Type MITRE: http://d-link.com Types: Product Added Reference Type MITRE: https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md Types: Exploit, Third Party Advisory Added Reference Type MITRE: https://www.dlink.com/en Types: Product Added Reference Type MITRE: https://www.dlink.com/en/security-bulletin/ Types: Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Nov. 14, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Added CWE CWE-77 -
New CVE Received by [email protected]
Nov. 13, 2025
Action Type Old Value New Value Added Description An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device. Added Reference http://d-link.com Added Reference https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md Added Reference https://www.dlink.com/en Added Reference https://www.dlink.com/en/security-bulletin/