CVE-2026-90693
Received Received - Intake

Stack-Based Buffer Overflow in D-Link DIR-878 Router

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90693
EUVD
EUVD-2026-77317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
d-link dir-878 120b05

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the D-Link DIR-878 router's SetWan3Settings function. It occurs when the function processes the Primary or Secondary arguments without proper length validation, allowing attackers to send oversized values that corrupt stack memory. The flaw stems from unsafe functions like sprintf and strcat being used without size limits.

Detection Guidance

To detect this vulnerability, check if your D-Link DIR-878 router is running firmware version 120B05. Scan for open ports 80 or 443 on the router's IP address. Send crafted HTTP requests to /SetWan3Settings/ConfigDNS/Primary or /SetWan3Settings/ConfigDNS/Secondary endpoints with oversized values to observe crashes or memory corruption.

Impact Analysis

Remote attackers can exploit this to crash the router's web management process, potentially gaining control or causing denial-of-service. Since the web interface is exposed, attackers on the same network or internet-facing instances could trigger the overflow by sending malicious requests to specific endpoints.

Mitigation Strategies

Immediately update the router's firmware to the latest version if available. Disable remote management access to the router's web interface. Block external access to ports 80 and 443 if not required. Monitor network traffic for unusual activity targeting these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart