CVE-2026-90880
Received Received - Intake

Command Injection in D-Link DSL-3782 Router

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-90880
EUVD
EUVD-2026-78270

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
d-link dsl-3782 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in the D-Link DSL-3782 router. It occurs in the Diagnostics component at the /cgi-bin/New_GUI/Set/Diagnostics.asp endpoint. An attacker can manipulate the Addr parameter to inject shell commands, which are executed with root privileges due to a system() call in the backend. The Addr parameter is meant for diagnostics but is not properly validated or sanitized before use.

Detection Guidance

Check if your D-Link DSL-3782 device is accessible via the web interface at /cgi-bin/New_GUI/Set/Diagnostics.asp. Test the Addr parameter by sending crafted input like 'Addr=1.1.1.1; id' to see if arbitrary commands execute. Verify filesystem changes after sending requests to confirm command injection.

Impact Analysis

An authenticated attacker could exploit this to fully compromise the device. This includes stealing credentials, intercepting network traffic, or installing persistent backdoors. The attacker needs authentication but can then execute arbitrary commands with root-level access, giving them full control over the router and connected devices.

Compliance Impact

This vulnerability allows authenticated attackers to execute arbitrary commands on the device with root privileges. Such unauthorized access could lead to data breaches, unauthorized data access, or manipulation, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by exposing sensitive information or failing to ensure data integrity and confidentiality.

Mitigation Strategies

Disable remote access to the web interface if possible. Apply strict input validation for the Addr parameter. Replace system() calls with safer exec* functions. Ensure all user inputs are shell-escaped. Monitor network traffic for unusual activity from the device.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart