D-Link DIR-878 Routers Vulnerable to Remote Code Execution Flaws

D-Link has issued a warning regarding significant security vulnerabilities affecting all versions of its DIR-878 routers, which were discontinued in 2021. The vulnerabilities, tracked as CVE-2025-60672, CVE-2025-60673, CVE-2025-60674, and CVE-2025-60676, are categorized as remote code execution (RCE) flaws with severity scores ranging from 6.5 to 6.8 out of 10, indicating a medium level of risk. The first two vulnerabilities allow for unauthenticated command execution, the third involves a stack overflow in USB storage handling, and the last pertains to arbitrary command execution.

TechRadar

The DIR-878 router was initially released in 2017 and has been primarily used in residential and small office environments. Despite its discontinuation, it remains available for purchase, both new and used, at prices between $75 and $125. The router's end-of-life status makes it particularly appealing to cybercriminals, as outdated hardware is often targeted for exploitation.

TechRadar

Security researcher Yangyifan has published proof-of-concept (PoC) exploit code for these vulnerabilities, raising concerns about imminent real-world attacks. Notably, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has yet to include these vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, which could delay awareness and response efforts.

TechRadar

The vulnerabilities pose a significant risk, as compromised routers can be integrated into large botnets, such as Mirai and Aisuru, which are known for conducting Distributed Denial of Service (DDoS) attacks and other malicious activities. Cybercriminals can exploit these routers for various purposes, including residential proxy services, which obscure their activities behind the compromised devices.

TechRadar

D-Link advises users to replace outdated hardware with newer models to mitigate these risks. If replacement is not feasible, users should ensure that they have installed the latest firmware updates and maintain strong, frequently updated passwords to enhance security.

TechRadar

Some cybersecurity experts have criticized the lack of immediate action from CISA regarding the inclusion of these vulnerabilities in the KEV catalog. The delay may hinder proactive measures that could protect users from potential exploitation.

TechRadar

• “Still, with the PoC out there, it is safe to assume it’s only a matter of time before real-life attacks start.” — TechRadar

TechRadar

• “The best way to defend against these flaws is to replace the outdated hardware with a newer model.” — D-Link Advisory

TechRadar

As the situation develops, users of the DIR-878 router should remain vigilant for updates from D-Link and cybersecurity agencies regarding potential exploits and recommended actions.

TechRadar