CVE-2026-90680

Executive Summary

CVE-2026-90680 is a stack-based buffer overflow (CWE-119) in the D-Link DIR-823G router running firmware 1.0.2B05_20181207, specifically within the strcpy function handling the PAddress, SubnetMask, and Gateway arguments of the /HNAP1/SetStaticRouteSettings endpoint under the HNAP1 component. The flaw is remotely exploitable and carries a CVSS 3.1 base score of 9.9 (Critical), reflecting low attack complexity, network reachability, and high confidentiality, integrity, and availability impact with scope change. No public proof-of-concept, exploit code, or Nuclei template is currently available, and no vendor patch exists, leaving affected devices fully exposed.

Technical Analysis

The vulnerability resides in the HNAP1 (Home Network Administration Protocol) service exposed by the D-Link DIR-823G router. HNAP1 is a SOAP-based management protocol historically implemented on D-Link consumer and SOHO routers, typically reachable over the LAN management interface and, on some configurations, over the WAN if remote administration is enabled.

The affected code path is the SetStaticRouteSettings action of the /HNAP1/ handler. The NVD description states that the impacted element is the strcpy function within the file handling this action, and that manipulation of the PAddress, SubnetMask, and Gateway arguments results in a stack-based buffer overflow. The vulnerable pattern is a classic unbounded copy: user-supplied string arguments are passed to strcpy (or an equivalent copy into a fixed-size stack buffer) without length validation. Because strcpy copies until a NUL terminator, an attacker who supplies an input longer than the destination buffer overwrites adjacent stack memory — including saved frame pointers and return addresses.

Key technical characteristics:

• Vulnerability class: Stack-based buffer overflow (CWE-119, improper restriction of operations within the bounds of a memory buffer).
• Attack vector: Network (AV:N). The attacker sends a crafted HNAP1 request containing oversized values for PAddress, SubnetMask, and/or Gateway.
• Privileges required: Low (PR:L). The CVSS vector indicates some authentication or authorization context is needed to reach the vulnerable handler, consistent with HNAP1 actions requiring a valid session in typical D-Link implementations.
• User interaction: None (UI:N) — exploitation is fully automated from the network.
• Scope: Changed (S:C), meaning a compromise can affect resources beyond the immediately vulnerable component (e.g., full device control, pivot capability).

Because no public analysis or PoC exists, the exact buffer size, offset to the return address, and available mitigations (ASLR, NX, stack canaries) on the target firmware cannot be confirmed from available data. The precise exploitation primitive therefore remains theoretical until reproduced, but the class of bug is well understood and reliably weaponizable when mitigations are weak — as is common on legacy embedded MIPS/ARM router firmware.

Attack surface: The /HNAP1/SetStaticRouteSettings action requires an HNAP1 request containing the static route parameters. The endpoint parses attacker-controlled fields and routes them into the vulnerable copy. This is a pre- or post-authentication network-reachable management action depending on configuration.

Exploitation Scenarios

Because no public PoC or exploit code is available, the following chain is described at the vulnerability-class level and strictly constrained to components named in the NVD description. No specific offsets, gadgets, or shellcode layouts are asserted.

1. Reconnaissance / target identification. An attacker scans for exposed D-Link DIR-823G management interfaces. This can be done via internet-wide scanning (Shodan/Censys queries targeting the HNAP1 service or product banner) or by locating the device on an internal network. The presence of the HNAP1 endpoint (/HNAP1/) and reachability of SetStaticRouteSettings determine exploitability. Remote administration, if enabled, expands the attack surface to the WAN.

2. Triggering the flaw class. The attacker issues an HNAP1 SOAP request to /HNAP1/SetStaticRouteSettings supplying oversized values for PAddress, SubnetMask, or Gateway. The handler passes these arguments to strcpy without bounds checking, and the copy overflows a fixed-size stack buffer. This is the specific defect: unbounded string copy of attacker-controlled route parameters into stack memory.

3. Payload / execution mechanism. At the vulnerability-class level, a stack buffer overflow of this kind is exploited by crafting input that overwrites the saved return address (and/or other stack-resident control data) with attacker-chosen values, redirecting execution. Depending on the target architecture and enabled mitigations, the attacker may achieve control-flow hijacking leading to arbitrary code execution in the context of the HNAP1 service. The exact technique (return-to-libc, ROP, direct shellcode placement) depends on the runtime environment and cannot be stated from the available data.

4. Post-exploitation impact. Given scope change (S:C) and high CIA impact, successful exploitation can yield full control of the router: traffic interception/manipulation, DNS hijacking, credential capture, persistence, and use of the device as a pivot into the internal network. Because routers sit at trust boundaries, compromise is high-severity for downstream networks.

Note: No public PoC available; attack chain is inferred from the announced vulnerability class and the named endpoint/parameters. Reproduction and weaponization details are unconfirmed.

Impact Assessment

• CVSS 3.1 base score: 9.9 (Critical). Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
• Confidentiality / Integrity / Availability: All rated High — full compromise of device data, configuration, and functionality.
• Scope: Changed — a vulnerability in the HNAP1 component can impact the wider device and network beyond the immediate vulnerable function.
• Affected systems: D-Link DIR-823G routers running firmware 1.0.2B05_20181207. The device is an older-generation consumer/SOHO router; deployments are typically at network perimeters or internal access layers.
• Blast radius: Because these devices act as gateways, compromise enables man-in-the-middle, DNS manipulation, and lateral movement into connected networks. SOHO routers are frequently targeted en masse by botnets for DDoS and proxy purposes.
• Exploitability state: No public exploit, no PoC, no Nuclei template at time of reporting. EPSS has not yet scored this CVE (not fabricated here). Not listed in CISA KEV.
• Patch status: UNPATCHED — patch confidence 0/4, no patch sources, no affected-version list, no vendor fix or workaround recorded.

Detection Guidance

Detection focuses on (a) anomalous HNAP1 requests to the device and (b) memory-corruption/exploitation signatures on the network and host level. Generic HNAP1 inspection is valuable because the vulnerable action is explicitly named.

Sigma Rule

title: D-Link DIR-823G HNAP1 SetStaticRouteSettings Buffer Overflow Attempt
id: 8f3c9a12-7b2e-4d61-9c0a-2f6b7e1d4a90
status: experimental
description: Detects oversized or anomalous HNAP1 SetStaticRouteSettings requests targeting the D-Link DIR-823G management endpoint, potentially exploiting a stack-based buffer overflow (CVE-2026-90680).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90680
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-90680
logsource:
  category: webserver
  product: dlink
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/HNAP1/'
  selection_action:
    cs-uri-query|contains: 'SetStaticRouteSettings'
  selection_payload:
    cs-uri-query|re: '(?i)(PAddress|SubnetMask|Gateway)=.{64,}'
  condition: selection_endpoint and (selection_action or selection_payload)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrative configuration with unusually long values (unlikely)
level: high

YARA Rule

rule CVE_2026_90680_DLink_DIR823G_HNAP1_BOF
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects HNAP1 SetStaticRouteSettings overflow payloads targeting D-Link DIR-823G (CVE-2026-90680)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90680"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $hnap = "SetStaticRouteSettings" ascii nocase
        $p1   = "PAddress" ascii nocase
        $p2   = "SubnetMask" ascii nocase
        $p3   = "Gateway" ascii nocase
        $soap = "soap" ascii nocase
        $hnap_uri = "/HNAP1/" ascii

    condition:
        any of ($hnap_uri, $hnap, $soap) and 2 of ($p1, $p2, $p3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90680 D-Link DIR-823G HNAP1 SetStaticRouteSettings Buffer Overflow Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1/"; http.request_body; content:"SetStaticRouteSettings"; nocase; http.request_body; pcre:"/(?:PAddress|SubnetMask|Gateway)[^&]{100,}/i"; reference:cve,2026-90680; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90680; classtype:attempted-admin; sid:202690680; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.id, source.ip with maxspan=10s
  [network where network.protocol == "http" and
     url.path : "/HNAP1/*" and
     http.request.method == "POST"]
  [network where network.protocol == "http" and
     url.path : "/HNAP1/*" and
     http.request.body.text : ("*SetStaticRouteSettings*" or "*PAddress*" or "*SubnetMask*" or "*Gateway*") and
     length(http.request.body.text) > 512]

Splunk SPL Query

index=web sourcetype=dlink_router_access
| search uri_path="/HNAP1/*"
| eval suspicious_action=if(match(uri_query, "(?i)SetStaticRouteSettings"), 1, 0)
| eval oversized_param=if(match(uri_query, "(?i)(PAddress|SubnetMask|Gateway)=.{64,}"), 1, 0)
| where suspicious_action=1 OR oversized_param=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as payload by src_ip uri_path http_user_agent
| sort - count

Note: field names (uri_path, uri_query, src_ip, http_user_agent) should be mapped to the deployment’s actual CIM/parser schema.

Wazuh OSSEC Rule

<group name="web,dlink,hnap,">
  <rule id="100680" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/HNAP1/</url>
    <description>CVE-2026-90680: HNAP1 request to D-Link DIR-823G management endpoint detected</description>
    <options>no_full_log</options>
  </rule>

  <rule id="100681" level="14">
    <if_sid>100680</if_sid>
    <regex>SetStaticRouteSettings</regex>
    <description>CVE-2026-90680: SetStaticRouteSettings action invoked - possible stack buffer overflow attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100682" level="15">
    <if_sid>100681</if_sid>
    <regex>(?i)(PAddress|SubnetMask|Gateway)=.{64,}</regex>
    <description>CVE-2026-90680: Oversized route parameter in HNAP1 request - active exploitation attempt</description>
  </rule>
</group>

Wazuh decoders for the router’s access/management log may require custom regex; the rules above assume fields are extractable from the device or forwarded proxy logs.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix, workaround, or patch source is currently recorded for CVE-2026-90680. The affected firmware (1.0.2B05_20181207) is a legacy release, and the device may be end-of-support.

1. Immediate mitigations

   • Disable remote (WAN) administration on the DIR-823G. Restrict management access to trusted internal hosts only.
   • Block or restrict access to the /HNAP1/ endpoint at the network edge and via host-based firewall where possible.
   • Segment the device onto a dedicated management VLAN; prevent untrusted hosts from reaching HTTP/HNAP management.
   • If HNAP1 functionality is not required, disable it if the firmware permits.
   • Monitor and rate-limit POST requests to /HNAP1/ containing SetStaticRouteSettings.

2. Patch / upgrade steps

   • Check the D-Link support portal for a firmware release newer than 1.0.2B05_20181207 that addresses this CVE. No such fix is confirmed as of this report.
   • If no fix is forthcoming and the device is end-of-life, replace the hardware with a supported model.
   • Track the NVD entry for status changes; re-evaluate when vendor or CNA updates are published.

3. Long-term hardening

   • Maintain an accurate hardware/firmware inventory; retire unsupported network-edge devices.
   • Enforce network segmentation so that compromise of a SOHO router does not grant broad internal reach.
   • Adopt egress DNS/DNS-over-HTTPS monitoring to detect hijacking following router compromise.
   • Apply least-privilege management: strong unique credentials, no default accounts, restricted admin sources.
   • Continuously scan external exposure for HNAP1/management interfaces.

References

1. NVD — CVE-2026-90680: https://nvd.nist.gov/vuln/detail/CVE-2026-90680
2. MITRE CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. D-Link Security Advisory / Support Portal (monitor for a fix): https://support.dlink.com/
5. CISA Known Exploited Vulnerabilities Catalog (verify current status; not listed at time of report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None recorded. No public PoC, exploit code, Nuclei template, or CISA KEV listing at time of writing. EPSS not yet scored by FIRST.org. Detection content above is derived from the vulnerability class and the named endpoint/parameters only.