CVE-2026-90693

D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow exists in the SetWan3Settings function of the D-Link DIR-878 120B05 router firmware. By manipulating the Primary/Secondary argument, an attacker can cause an overflow on the call stack. Remote exploitation is possible, meaning an attacker can send crafted data from outside the network to trigger the overflow and gain arbitrary code execution on the device, compromising network confidentiality, integrity, and availability. The flaw is associated with CWE-119 and CWE-121 weaknesses.

Affected Systems

The vulnerability affects D-Link DIR-878 routers running firmware version 120B05. No other versions are listed as impacted.

Risk and Exploitability

The CVSS score of 9.4 indicates a critical severity. The EPSS score is less than 1%, indicating a very low but non-zero exploitation probability, and the vulnerability is not listed in CISA KEV, which does not alter the high potential for exploitation. The likely attack vector is remote network access to the router’s WAN interface, requiring only network connectivity and no prior local privileges. Once exploited, the attacker would achieve full control over the routing device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an updated firmware that fixes the SetWan3Settings buffer overflow usage.
  • Disable or restrict remote WAN management features to prevent external access from executing the vulnerable function.
  • Configure network firewall rules to block management interfaces.

Generated by OpenCVE AI on September 15, 2026 at 14:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.
Title D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow
First Time appeared D-link
D-link dir-878
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:d-link:dir-878:*:*:*:*:*:*:*:*
Vendors & Products D-link
D-link dir-878
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 15, 2026, 3:59 PM
Reserved
Sep 13, 2026, 5:09 AM

View source JSON

Updated
Sep 15, 2026, 3:59 PM

JSON

Status
Deferred
Published
Sep 14, 2026, 8:16 AM
Modified
Sep 15, 2026, 5:17 PM

View source JSON

No data.

Updated
Sep 15, 2026, 3:00 PM

JSON