CVE-2025-60671: D-Link Dir-823g Firmware

Medium severity, CVSS 5.4. EPSS: 1.4% chance of exploitation in the next 30 days.

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit file. The vulnerability occurs because content read from this file is only partially validated for a prefix and then formatted using vsnprintf() before being executed with system(), allowing an attacker with write access to /var/system/linux_vlan_reinit to execute arbitrary commands on the device.

Affected products

• D-Link Dir-823g Firmware: version 1.0.2b05_20181207 only

Published 2025-11-13. Last modified 2026-07-05.