CVE-2026-90692

Executive Summary

CVE-2026-90692 is a stack-based buffer overflow (CWE-119) in the D-Link DIR-878 router firmware version 120B05, specifically within the SetDynamicDNSIPv6Settings function of the Dynamic DNS IPv6 Settings component. An authenticated remote attacker can trigger the flaw by manipulating the IPv6Address or Hostname argument, leading to potential code execution or denial of service. With a CVSS score of 9.9, the vulnerability poses a critical risk to affected devices, though no public exploit or patch currently exists.

Technical Analysis

The vulnerability resides in the SetDynamicDNSIPv6Settings function of the D-Link DIR-878's web management interface, which processes Dynamic DNS IPv6 configuration. The function fails to properly validate the length of the IPv6Address and Hostname parameters before copying them into a fixed-size stack buffer. By supplying an overly long string for either argument, an attacker can overwrite adjacent stack memory, including the return address, enabling control-flow hijacking. The attack is network-accessible (AV:N) and requires low privileges (PR:L), likely meaning an authenticated session or the ability to reach the configuration endpoint. The scope is changed (S:C) as the vulnerable component can affect other system resources. No public proof-of-concept or exploit code is available, and no Nuclei template exists. The flaw is a classic stack overflow, and exploitation would require bypassing common mitigations such as stack canaries or ASLR, though their presence in the firmware is unknown. The exact HTTP endpoint or request format is not specified in the NVD description; thus, the attack mechanism is inferred at the vulnerability-class level.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker scans for internet-exposed D-Link DIR-878 routers using Shodan dorks like product:"D-Link DIR-878" or http.title:"DIR-878". The attacker identifies the firmware version through banner grabbing or known endpoints.
2. Triggering the flaw: The attacker authenticates (or leverages an existing session) and navigates to the Dynamic DNS IPv6 Settings page. They then submit a maliciously crafted request to the SetDynamicDNSIPv6Settings function, providing an overly long IPv6Address or Hostname value.
3. Payload/execution method: The buffer overflow overwrites the return address on the stack. The attacker could inject shellcode or ROP gadgets to execute arbitrary code. Without a public exploit, specific payloads are unknown; however, the vulnerability class permits remote code execution if mitigations are bypassed.
4. Post-exploitation impact: Successful exploitation grants the attacker full control over the router, enabling persistent access, traffic redirection, man-in-the-middle attacks, or recruitment into a botnet. The CVSS score (C:H/I:H/A:H) indicates high confidentiality, integrity, and availability impact.

Impact Assessment

The CVSS 3.1 score of 9.9 (Critical) reflects a network-accessible, low-privilege attack that changes scope and has high impact on confidentiality, integrity, and availability. Affected systems are D-Link DIR-878 routers running firmware 120B05, commonly deployed in small office/home office (SOHO) environments. A successful exploit could compromise the entire network behind the router, intercept sensitive data, and disrupt connectivity. The blast radius includes all devices relying on the router for internet access, making it a high-value target for botnet operators and advanced persistent threats. The EPSS score of 0.00473 (39.7th percentile) suggests a low probability of exploitation in the wild currently, but the lack of a patch elevates the long-term risk.

Detection Guidance

Sigma Rule

title: D-Link DIR-878 SetDynamicDNSIPv6Settings Stack Buffer Overflow Attempt
id: 9a1b2c3d-4e5f-6789-abcd-ef0123456789
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2026-90692 via overly long IPv6Address or Hostname parameters.
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: dlink
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 'SetDynamicDNSIPv6Settings'
    cs-uri-query|re: '(IPv6Address|Hostname)=.{100,}'
  condition: selection
falsepositives:
  - Legitimate configuration with very long hostnames (unlikely)
level: critical
tags:
  - attack.t1190
  - cve.2026.90692

YARA Rule

rule CVE_2026_90692_DLink_DIR878_Stack_Overflow
{
    meta:
        description = "Detects exploitation attempts for CVE-2026-90692 in D-Link DIR-878 firmware"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90692"
        hash = "unknown"
    strings:
        $func = "SetDynamicDNSIPv6Settings" ascii wide nocase
        $param1 = "IPv6Address" ascii wide nocase
        $param2 = "Hostname" ascii wide nocase
    condition:
        uint32(0) == 0x464C457F and // ELF header
        any of ($func) and
        any of ($param1, $param2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90692 D-Link DIR-878 SetDynamicDNSIPv6Settings Buffer Overflow Attempt"; flow:to_server,established; content:"POST"; http_method; content:"SetDynamicDNSIPv6Settings"; http_uri; content:"IPv6Address="; http_client_body; pcre:"/IPv6Address=[^&]{100,}/Ri"; reference:cve,2026-90692; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

network where
  network.protocol == "http" and
  http.request.method == "POST" and
  http.request.body.text contains "SetDynamicDNSIPv6Settings" and
  (http.request.body.text regex "IPv6Address=.{100,}" or http.request.body.text regex "Hostname=.{100,}")

Splunk SPL Query

index=web_logs (uri="*SetDynamicDNSIPv6Settings*" OR body="*SetDynamicDNSIPv6Settings*")
| regex body="(IPv6Address|Hostname)=.{100,}"
| stats count by src_ip, dest_ip, uri, body
| where count > 0

Wazuh OSSEC Rule

<group name="dlink,cve-2026-90692,">
  <rule id="100001" level="12">
    <decoded_as>web</decoded_as>
    <url>SetDynamicDNSIPv6Settings</url>
    <regex>IPv6Address=.{100,}|Hostname=.{100,}</regex>
    <description>CVE-2026-90692: D-Link DIR-878 stack buffer overflow attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_90692,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable remote management on the WAN interface and restrict administrative access to trusted LAN IPs only.
   • Change default credentials and enforce strong, unique passwords.
   • If the device is internet-facing, place it behind a firewall and disable UPnP.
   • Monitor for anomalous HTTP POST requests containing SetDynamicDNSIPv6Settings with long parameters.
   • Consider network segmentation to isolate affected routers.

2. Patch/upgrade steps:

   • No official patch exists for firmware 120B05. Check D-Link's security advisory page regularly for updates.
   • If a patched firmware is released, back up configuration, apply the update, and verify the version.
   • If D-Link declares end-of-life, replace the device with a supported model.

3. Long-term hardening:

   • Implement a vulnerability management program that tracks firmware versions and vendor advisories.
   • Replace unsupported hardware proactively.
   • Enable logging and integrate with a SIEM to detect exploitation attempts.
   • Conduct regular penetration testing on network edge devices.

References

1. NVD – CVE-2026-90692: https://nvd.nist.gov/vuln/detail/CVE-2026-90692
2. CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer – https://cwe.mitre.org/data/definitions/119.html
3. D-Link Security Advisories: https://support.dlink.com/security-advisories/
4. MITRE ATT&CK T1190 – Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. EPSS Score for CVE-2026-90692: https://api.first.org/data/v1/epss?cve=CVE-2026-90692

No known threat actor campaigns or exploit-in-the-wild evidence have been observed.