CVE-2026-90692: D-Link DIR-878 Vulnerability
TL;DR - CVE-2026-90692 is a critical stack-based buffer overflow in D-Link DIR-878 firmware 120B05. - The Dynamic DNS IPv6 settings handler processes attacker-controlled
IPv6AddressandHostnamevalues. - No fixed firmware version is confirmed. Isolate management, disable the feature, and plan replacement.
CVE-2026-90692 Summary
CVE-2026-90692 affects the D-Link DIR-878 wireless router running firmware 120B05. The vulnerable code is associated with the SetDynamicDNSIPv6Settings function in the Dynamic DNS IPv6 Settings component. The reported issue is a remotely reachable stack-based buffer overflow caused by insufficient length validation of configuration inputs.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-90692 |
| CVSS v3.1 score | 9.9 Critical |
| CVSS v3.1 vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Attack vector | Network |
| Authentication or privileges required | Low privileges required (PR:L) |
| User interaction | None required |
| Patch available | No confirmed vendor patch |
| Affected firmware identified | D-Link DIR-878 firmware 120B05 |
| Fixed version | Not established |
The vulnerability is remotely reachable in the CVSS model, but successful exploitation still requires the attacker to satisfy the low-privilege requirement. Separate an Internet-exposed administrative interface from one restricted to a trusted LAN or VPN. Public exposure of the router’s administration plane substantially increases practical risk.
A secondary listing reports a CVSS 4.0 score of 9.4. The NVD-recorded CVSS v3.1 score and vector should remain the primary severity reference for standard vulnerability-management workflows. No EPSS value was provided in the available research note, so defenders should not use an assumed EPSS value to downgrade this issue.
For broader context on assessing network vulnerability risk, see our guide to threat intelligence platforms and how they work.
Root Cause
The reported root cause is inadequate bounds checking in SetDynamicDNSIPv6Settings. The handler processes the IPv6Address and Hostname parameters and reportedly copies attacker-controlled data into a fixed-size stack buffer without properly enforcing the destination buffer’s length.
When input exceeds the expected size, data can overwrite adjacent stack memory. The immediate result may be a process crash or router reboot. Depending on the firmware’s memory protections, process privileges, compilation settings, and the attacker’s ability to control overwritten data, the same flaw could potentially support arbitrary code execution. The available sources do not establish reliable code-execution behavior, so defenders should treat that outcome as possible rather than confirmed.
The weakness is located in a configuration-management path rather than a general packet-forwarding function. Disabling Dynamic DNS IPv6 may prevent normal access to this handler, but it does not remove the underlying defect from the firmware. Other configuration handlers and related DIR-878 findings should be assessed separately; they should not be conflated with this CVE without independent evidence.
Technical Notes
The affected input names identified in the available vulnerability description are:
IPv6Address
Hostname
The relevant handler is:
SetDynamicDNSIPv6Settings
No trustworthy public exploit details were established in the supplied research. Do not reproduce oversized payloads against production routers. If testing is necessary, use an isolated device, preserve a firmware image and configuration backup, and obtain authorization before sending malformed values.
Who Is Exposed?
The specifically identified affected product is the D-Link DIR-878 running firmware version 120B05. The available NVD data names that firmware version, but it does not provide a broader vulnerable range such as “all versions before X.” Administrators should not assume that every DIR-878 release is vulnerable, and they should not assume that another firmware version is safe without confirmation from D-Link or controlled firmware analysis.
Exposure depends on both firmware and management-plane reachability. A DIR-878 running 120B05 with administration exposed to the Internet presents a materially higher-risk configuration than the same device managed only from a segmented internal network. Internal-only exposure is not equivalent to no exposure: a compromised workstation, malicious insider, or adjacent attacker may still reach the router’s management interface.
The Dynamic DNS IPv6 feature is the relevant functional exposure described by the vulnerability record. Devices that do not use Dynamic DNS IPv6 may have a reduced attack surface if the feature can be disabled successfully, but that configuration change should not be treated as a patch. Organizations should inventory the exact firmware version and management settings rather than relying only on the product model.
Severity Breakdown
The primary CVSS v3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Its components indicate the following:
| Component | Value | Practical meaning |
|---|---|---|
| Attack Vector | Network (AV:N) |
The vulnerable function can be reached over a network path. |
| Attack Complexity | Low (AC:L) |
No unusual conditions are required beyond the vulnerable service being reachable. |
| Privileges Required | Low (PR:L) |
The attacker needs limited privileges or authentication. |
| User Interaction | None (UI:N) |
No separate victim action is required after the attack is initiated. |
| Scope | Changed (S:C) |
Impact can cross the security authority or privilege boundary of the vulnerable component. |
| Confidentiality | High (C:H) |
Successful exploitation could expose sensitive information. |
| Integrity | High (I:H) |
Successful exploitation could enable unauthorized changes. |
| Availability | High (A:H) |
Successful exploitation could cause crashes, disruption, or loss of service. |
The resulting score is 9.9, classified as Critical. The score reflects the potential impact of a successful exploit, not proof that arbitrary code execution has been demonstrated in the field. The low-privilege requirement also means administrators must evaluate whether the router’s management interface permits unauthenticated access, weak credentials, broad administrative access, or exposure through remote-management features.
A Rapid7 listing also reports a CVSS 4.0 score of 9.4 with high impact across vulnerable and subsequent systems. Because the available record does not establish the complete context behind that secondary score, use the NVD CVSS v3.1 score for consistency while retaining the same operational conclusion: Internet-reachable DIR-878 management interfaces running 120B05 require immediate risk reduction.
Exploitation Status
CVE-2026-90692 is not currently listed in CISA’s Known Exploited Vulnerabilities catalog according to the supplied research. There is no CISA confirmation of active exploitation, no KEV-driven federal remediation deadline, and no CISA ransomware-campaign attribution for this CVE.
Public vulnerability research is available through a GitHub advisory page linked from the CVE references. That material establishes public technical disclosure, but the supplied evidence does not confirm a reliable weaponized exploit, an operational exploit kit, or exploitation in the wild. A public advisory or proof-of-concept-like document should not automatically be interpreted as evidence of active attacks.
The current assessment is:
| Question | Status |
|---|---|
| Public research or advisory | Yes, a GitHub advisory is referenced |
| Reliable public exploit repository confirmed | No |
| Confirmed exploitation in the wild | Not established |
| CISA KEV listing | No |
| Ransomware exploitation confirmed | No |
Analyst’s Take: The absence of KEV status or confirmed exploitation does not lower the priority for an Internet-exposed DIR-878 running firmware 120B05. Management-plane isolation is the first risk-reduction step because the issue requires network reachability and low privileges. Disabling Dynamic DNS IPv6 can reduce access to the reported handler, but it does not repair the firmware defect.
Routers are edge devices, often remain exposed for long periods, and may be difficult to monitor. Treat an Internet-exposed device running firmware 120B05 as high priority even though active exploitation has not been confirmed.
Sources
The NVD record identifies CVE-2026-90692 as a remotely exploitable stack-based buffer overflow in the D-Link DIR-878 SetDynamicDNSIPv6Settings function and names firmware 120B05. It records the primary CVSS v3.1 score as 9.9 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The NVD publication date supplied for this issue is September 14, 2026, with a last-modified date of September 15, 2026.
The following references were supplied for this assessment:
- GitHub vulnerability research and advisory
- VulDB CVE record
- Rapid7 Vulnerability Database
- Third-party reporting on DIR-878 exposure and reported patch status
No D-Link primary security advisory or confirmed fixed firmware version was identified in the supplied material. Organizations should verify any later vendor communication directly with D-Link before treating a firmware release as a confirmed remediation for CVE-2026-90692.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Start with asset discovery. Identify every DIR-878, record its firmware version, and determine whether its administrative interface is reachable from the Internet, a user VLAN, guest networks, wireless segments, or remote-access paths. Review configuration backups and management-plane ACLs for Dynamic DNS and IPv6 settings.
Look for indicators consistent with exploitation or attempted exploitation:
- Repeated administrative requests involving Dynamic DNS IPv6 configuration
- Unusually long parameter values
- Router crashes or spontaneous reboots
- Unexpected configuration changes
- Newly enabled remote management
- Outbound connections that do not match normal DNS or update behavior
These indicators are not CVE-specific proof because the supplied sources do not provide a formal network signature.
Technical Notes
If reverse-proxy, firewall, or router-management logs capture query parameters, search for the handler or field names and flag unusually long values:
SetDynamicDNSIPv6Settings
IPv6Address=
Hostname=
A generic SIEM query for HTTP-based management logs can be adapted as follows:
index=network OR index=firewall OR index=router
(
"SetDynamicDNSIPv6Settings"
OR "IPv6Address="
OR "Hostname="
)
| eval request_length=len(_raw)
| where request_length > 1000
| stats count values(src_ip) values(dest_ip) by host, user, uri_path
The 1,000-character threshold is a triage heuristic, not a validated exploit signature. Tune it to the router’s normal management traffic and inspect the underlying request. If management traffic is encrypted or not logged, enable logging at a trusted reverse proxy or management jump host where feasible, without exposing the router to the public Internet.
Also correlate suspected requests with device events:
index=router
| transaction device_id maxspan=10m
| search ("SetDynamicDNSIPv6Settings" OR "IPv6Address=" OR "Hostname=")
| search (reboot OR crash OR "configuration changed" OR watchdog)
Preserve timestamps, source addresses, authenticated usernames, configuration snapshots, and firmware details. A crash alone does not prove exploitation, but a malformed configuration request followed by a reboot or unauthorized configuration change warrants incident-response triage.
Remediation Steps
No D-Link security advisory or fixed firmware version was identified in the supplied research. The fixed version is therefore not established. Do not tell users to upgrade to a fabricated version, and do not assume that the latest file found on an unofficial download site resolves this CVE.
Immediately remove Internet exposure from the router’s management interface. Restrict administration to a trusted internal management network or VPN, disable remote administration, and apply explicit firewall rules that deny untrusted source networks. If Dynamic DNS IPv6 is not required, disable it. If the device is unsupported or cannot be upgraded through a vendor-supported release, replace it with currently supported hardware.
If compromise is suspected, rotate administrative credentials using unique passwords stored in an approved enterprise password manager, such as Try 1Password →, and review access logs for unauthorized activity.
Technical Notes
The exact configuration command depends on the DIR-878 firmware interface and deployment model. Use the device’s documented administrative interface to disable Dynamic DNS IPv6, then verify the resulting configuration and management exposure. At minimum, apply an upstream ACL or firewall rule equivalent to:
deny tcp <untrusted-networks> -> <router-management-ip> <management-port>
permit tcp <trusted-admin-vlan> -> <router-management-ip> <management-port>
Do not copy these placeholders directly into a production firewall. Substitute the actual management IP, ports, trusted administrative VLAN, and untrusted networks. If the router is managed through HTTP or HTTPS, restrict both management protocols unless the platform requires one for local administration.
A practical response sequence is:
- Inventory DIR-878 devices and confirm whether firmware 120B05 is installed.
- Disable Internet-facing administration and restrict access to a management VLAN or VPN.
- Disable Dynamic DNS IPv6 if the feature is not operationally required.
- Export a known-good configuration and record the current firmware and settings.
- Contact D-Link support or consult an authenticated vendor distribution channel for a supported fix.
- Replace the router if no supported firmware is available or the device is end-of-life.
- Review logs and configuration history for suspicious requests, reboots, or unauthorized changes.
- Reset administrative credentials if compromise is suspected, and investigate adjacent devices.
Feature disablement reduces exposure to the reported handler but does not repair the memory-safety flaw. A router that cannot receive a vendor-supported fix should be considered a replacement candidate, especially when it performs Internet-edge functions or supports sensitive networks.
Administrators reviewing broader Microsoft 365 access controls may also find our Microsoft 365 security FAQ useful when separating router compromise risks from cloud-account risks.