Description
A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of the argument IPv6Address/Hostname results in stack-based buffer overflow. The attack may be launched remotely.
Published: 2026-09-14
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Assess Impact
AI Analysis

Impact

This vulnerability is a stack‑based buffer overflow in the SetDynamicDNSIPv6Settings component on D‑Link DIR‑878 firmware 120B05. An attacker can supply an oversized IPv6 address or hostname argument, causing the firmware to overrun a buffer on the stack. The description states the attack may be launched remotely, allowing a malformed request to trigger overflow and execute arbitrary code in the router’s context.

Affected Systems

The flaw impacts D‑Link DIR‑878 firmware 120B05. Other firmware revisions are not reported as affected at this time.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.4, indicating critical severity, and the EPSS score is <1%. It is not listed in the CISA KEV catalog. The attack may be launched remotely through the router’s management interface by sending a crafted IPv6 dynamic DNS configuration request. Based on the description, it is inferred that exploitation could allow an attacker to arbitrarily execute code on the device, potentially giving them elevated control over the network infrastructure.

Generated by OpenCVE AI on September 14, 2026 at 20:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Configure strict input validation on the SetDynamicDNSIPv6Settings API, ensuring the IPv6 address and hostname fields do not exceed the maximum lengths defined by the firmware to mitigate the bounds‑checking weakness identified by CWE‑119 and CWE‑121.
  • If the firmware cannot enforce input limits, temporarily disable the Dynamic DNS IPv6 configuration feature to prevent attackers from triggering the overflow.
  • Restrict remote management access to the router’s interface by blocking external requests through a firewall or enforcing management only from the internal network or a secured VPN.

Generated by OpenCVE AI on September 14, 2026 at 20:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 07:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of the argument IPv6Address/Hostname results in stack-based buffer overflow. The attack may be launched remotely.
Title D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow
First Time appeared D-link
D-link dir-878
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:d-link:dir-878:*:*:*:*:*:*:*:*
Vendors & Products D-link
D-link dir-878
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X'}

Subscriptions

D-link Dir-878
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-14T07:00:08.862Z

Reserved: 2026-09-13T05:09:14.905Z

Link: CVE-2026-90692

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-14T07:17:25.263

Modified: 2026-09-14T20:56:48.220

Link: CVE-2026-90692

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-14T21:00:09Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow