Medium severity · published Nov 13, 2025
CVE-2025-60675
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the…
5.4
CVSS
1.5%
EPSS
No
On KEV
Description
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /tmp/new_qos.rule configuration file. The vulnerability occurs because parsed fields from the configuration file are concatenated into command strings and executed via system() without any sanitization. An attacker with write access to /tmp/new_qos.rule can execute arbitrary commands on the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dir-823g Firmware · Dlink
1.0.2b05_20181207 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-60675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-60675
Exploit
https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-823G/CVE-2025-60675.md
Product
https://www.dlink.com/en
Vendor Advisory
https://www.dlink.com/en/security-bulletin/
More from Dir-823g Firmware
9.8
CVE-2025-2360
A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207
9.8
CVE-2025-2359
A vulnerability classified as critical has been found in D-Link DIR-823G 1.0.2B05_20181207
9.8
CVE-2024-13030
D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access control
9.8
CVE-2023-43241
D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity
9.8
CVE-2023-43235
D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings