Multiple Flaws in EoL/EoS Routers Enable Remote Code Execution

D-Link has disclosed four critical security vulnerabilities affecting the DIR-878 router, a device that reached end-of-life status on January 31, 2021.

These flaws expose all hardware revisions and firmware versions to remote code execution attacks, posing significant risks to organizations and users still relying on this legacy equipment.

D-Link published the security advisory on November 17, 2025, marking the formal notification of these dangerous weaknesses that attackers can exploit without any authentication.

Critical Remote Code Execution Vulnerabilities

Two of the four vulnerabilities enable unauthenticated remote attackers to execute arbitrary commands on affected routers.

CVE-2025-60672 affects the SetDynamicDNSSettings functionality in the program cgi script.

Attackers can manipulate the ServerAddress and Hostname parameters, which are stored in NVRAM and later executed through the twsystem() function.

This flaw receives a 9.8 critical CVSS score due to its ease of exploitation and severe impact.

Similarly, CVE-2025-60673 targets the SetDMZSettings function, where the unvalidated IPAddress parameter is used to run iptables commands, resulting in arbitrary code execution with critical severity ratings.

CVE-2025-60674 involves a stack buffer overflow in the rc binary’s USB storage handling module.

When the router reads a serial number field from a connected USB device, it accepts up to 127 bytes into a 64-byte buffer, causing memory corruption.

While this flaw requires physical access to or control over a USB device, successful exploitation allows arbitrary code execution, resulting in a CVSS score of 8.4.

CVE-2025-60676 affects the timelycheck and sysconf binaries, which process the /tmp/new_qos rule configuration file without proper input sanitization.

An attacker with write access to this temporary file can inject arbitrary commands, earning an 8.8 high-severity rating.

Since the DIR-878 reached end-of-life status over four years ago, D-Link will not release security patches or firmware updates.

The company recommends users transition to current-generation products, perform comprehensive data backups, and contact regional support offices for guidance.

Organizations unable to immediately replace affected routers should implement network segmentation, turn off remote management features, enforce strong authentication, and maintain up-to-date password protections.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and set GBH as a Preferred Source in Google.