CVE-2025-60671
📋 TL;DR
A command injection vulnerability in D-Link DIR-823G router firmware allows attackers with write access to /var/system/linux_vlan_reinit to execute arbitrary commands on the device. This affects users of DIR-823G routers running vulnerable firmware versions. The vulnerability stems from insufficient input validation before passing data to system().
💻 Affected Systems
- D-Link DIR-823G
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.
Likely Case
Local privilege escalation or limited command execution by authenticated attackers who gain write access to the vulnerable file.
If Mitigated
Minimal impact if proper access controls prevent unauthorized file writes and the device is not internet-facing.
🎯 Exploit Status
Exploitation requires write access to the vulnerable file, which typically means some level of access or another vulnerability is needed first.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Restart Required: Yes
Instructions:
1. Check D-Link security bulletin for firmware updates. 2. Download latest firmware from official D-Link website. 3. Upload firmware through router admin interface. 4. Reboot router after update.
🔧 Temporary Workarounds
Restrict file permissions
linuxChange permissions on vulnerable file to prevent unauthorized writes
chmod 600 /var/system/linux_vlan_reinit
chown root:root /var/system/linux_vlan_reinit
Remove vulnerable file
linuxDelete or rename the vulnerable file if not required for operation
rm /var/system/linux_vlan_reinit
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the router
- Monitor for unauthorized file modifications to /var/system/linux_vlan_reinit
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface or via SSH: cat /proc/version | grep DIR823GCheck Version:
cat /proc/version | grep -o 'DIR823G_V[0-9.]*'Verify Fix Applied:
Verify firmware version is newer than DIR823G_V1.0.2B05_20181207.bin and check file permissions on /var/system/linux_vlan_reinit📡 Detection & Monitoring
Log Indicators:
- Unusual system() calls in process logs
- Modifications to /var/system/linux_vlan_reinit file
- Suspicious commands executed from timelycheck or sysconf binaries
Network Indicators:
- Unusual outbound connections from router
- Unexpected services running on router
SIEM Query:
process.name IN ('timelycheck', 'sysconf') AND process.cmdline CONTAINS 'system('