Command Injection Vulnerability in SetDynamicDNSsettings (CVE-2025-60672) 1. Vulnerability Overview 2. Exploitation Path 3. Vulnerable Binaries prog.cgi rc The data flow traverses across these binaries. 4. 0-Day Command Injection Exploitation Path In prog.cgi, line 8: receives user input, which is temporarily stored via line 11: . In rc, line 23: retrieves the stored value, which is concatenated and passed to line 102: , resulting in command injection. The current logic only compares v6 against a specific string, but this does not prevent command injection. In prog.cgi, line 12: receives user input, which is temporarily stored via line 15: . In rc, line 24: retrieves the stored value, which is concatenated and passed to line 102: , resulting in command injection. 5. Proof of Concept (PoC) for Reproducing the Vulnerability