Description
A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-09-15
Score: 5.3 Medium
EPSS: 1.9% Low
KEV: No
Impact: Remote Command Injection
Action: Patch
AI Analysis

Impact

The vulnerability in the Diagnostics.asp component of the D‑Link DSL‑3782 allows a malicious actor to inject arbitrary system commands through the Addr parameter. This flaw falls under CWE‑74 (Command Injection) and CWE‑77 (User-Controlled Path Traversal), giving an attacker the ability to execute arbitrary commands on the device’s operating system and compromise confidentiality, integrity, or availability of the network infrastructure.

Affected Systems

The affected product is the D‑Link DSL‑3782 router, firmware version 2016‑07‑28. No other models or firmware revisions are listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score of 1% suggests a low but non‑negligible probability of exploitation. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the flaw remotely via the web interface, and an exploit has already been released to the public.

Generated by OpenCVE AI on September 17, 2026 at 18:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update released by D‑Link that addresses the command injection flaw
  • Configure network perimeter firewalls or router ACLs to block inbound access to the web management interface except from trusted IP addresses
  • Monitor device logs for abnormal command execution or unexpected traffic patterns that may indicate exploitation attempts

Generated by OpenCVE AI on September 17, 2026 at 18:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Title D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection
First Time appeared D-link
D-link dsl-3782
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:h:d-link:dsl-3782:*:*:*:*:*:*:*:*
Vendors & Products D-link
D-link dsl-3782
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

D-link Dsl-3782
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-15T17:54:32.697Z

Reserved: 2026-09-14T07:16:23.220Z

Link: CVE-2026-90880

cve-icon Vulnrichment

Updated: 2026-09-15T17:54:14.494Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T05:17:00.713

Modified: 2026-09-15T18:19:38.513

Link: CVE-2026-90880

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T21:00:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')