D-Link DIR-878 Reaches EOL: 3 Unpatched RCE Flaws Allow Unauthenticated Remote Command Execution

D-Link DIR-878 has reached End-of-Life and End-of-Service, with the company warning that three unauthenticated remote code execution flaws will not be patched. The advisory details four vulnerabilities across the DIR-878 firmware, three of which allow unauthenticated attackers to run arbitrary system commands by abusing CGI parameters or configuration files.

The flaws are CVE-2025-60672 (Dynamic DNS Command Injection), CVE-2025-60673 (DMZ Parameter Injection), CVE-2025-60674 (USB Serial Number Buffer Overflow requiring physical access), and CVE-2025-60676 (QoS Rule Injection leading to RCE). According to the advisory, an attacker can exploit the first two flaws remotely without authentication, while the USB and QoS issues present additional, yet distinct, attack scenarios.

D-Link notes that no patches will be released for DIR-878 due to its sunset status and urges users to replace the device or follow recommended steps, including backing up data and contacting a regional office for guidance.