CVE-2026-90693

Executive Summary

CVE-2026-90693 is a stack-based buffer overflow (CWE-119) in the D-Link DIR-878 wireless router running firmware version 120B05. The flaw resides in the WAN Settings component, specifically the SetWan3Settings function, and is triggered by manipulation of the Primary and Secondary arguments. The vulnerability carries a CVSS 3.1 base score of 9.9 (Critical), is remotely exploitable over the network, and currently has no vendor patch, no public proof-of-concept, and no evidence of exploitation in the wild.

Technical Analysis

The vulnerability is a stack-based buffer overflow affecting the SetWan3Settings function within the WAN Settings component of D-Link DIR-878 firmware 120B05. According to the available NVD description, the overflow is caused by improper bounds checking when the Primary and/or Secondary arguments are supplied to this function. When attacker-controlled input exceeding the allocated stack buffer size is written, adjacent stack memory (including saved registers and return addresses) is overwritten.

CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the assigned weakness class. The attack is network-reachable (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is marked Changed (S:C), indicating that exploitation can affect resources beyond the vulnerable component's original security authority — consistent with memory corruption leading to code execution or full device compromise. The impact subscores for confidentiality, integrity, and availability are all High (C:H/I:H/A:H).

The affected surface is the router's WAN configuration interface. Because SetWan3Settings is a configuration-handling function, the likely entry point is an HTTP or HNAP-style management request that carries the WAN settings parameters. The precise request path, HTTP method, and content type are not specified in the available description and should not be assumed. The Primary and Secondary parameters correspond to WAN connection settings (commonly DNS or WAN profile fields), and both are named as manipulation vectors in the NVD description.

No source code, disassembly, or crash analysis is publicly available for this CVE. As a result, the exact buffer size, the precise overflow offset, and the memory protection state of the firmware image (e.g., NX, ASLR, stack canaries) cannot be confirmed from the provided data. Any exploit development would require independent firmware analysis of version 120B05.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred at the vulnerability-class level from the NVD description and is not derived from observed exploit code.

1. Reconnaissance / target identification. An adversary scans internet-facing or LAN-adjacent networks for D-Link DIR-878 devices. Fingerprinting relies on device banners, web management interfaces, or known D-Link router signatures. Because the CVSS vector requires only low privileges (PR:L), the attacker may need either a valid low-privileged management session or network access to the device's management plane, depending on how the SetWan3Settings interface is exposed.

2. Triggering the flaw. The attacker sends a request that invokes the SetWan3Settings function with an oversized value in the Primary and/or Secondary argument. As documented, this manipulation causes a stack-based buffer overflow. The vulnerable component is the WAN Settings functionality of the DIR-878.

3. Payload / execution method. At the vulnerability-class level, a stack-based buffer overflow of this type allows the attacker to overwrite stack memory, potentially including the saved return address. A crafted payload would aim to redirect execution flow. Because no exploit code exists publicly and no firmware analysis is available, the specific corruption target, offset, and payload construction cannot be stated.

4. Post-exploitation impact. Consistent with the High confidentiality, integrity, and availability impact ratings and Changed scope, successful exploitation could result in arbitrary code execution with the privileges of the vulnerable service, full device compromise, manipulation of router configuration (including WAN/DNS settings that enable traffic redirection or interception), and participation in botnet or lateral-movement activity. Until a patch is released, the device should be considered fully compromiseable by any actor who can reach the vulnerable interface.

Impact Assessment

The CVSS 3.1 base score is 9.9 (Critical): AV:N (network exploitable), AC:L (no special conditions), PR:L (low privileges required), UI:N (no user interaction), S:C (scope changed), and C:H/I:H/A:H (high confidentiality, integrity, and availability impact). The Changed scope and triple-High impact profile indicate that exploitation can fully compromise the device and potentially affect connected network resources beyond the router itself.

Business impact is concentrated on organizations and home users running D-Link DIR-878 routers at firmware 120B05. Blast radius includes any network segment where the device acts as the WAN gateway or edge router: compromise enables traffic interception, DNS manipulation, credential harvesting, and use as a pivot point into internal networks. Because exploitation requires low privileges rather than none, exposure depends on whether the management interface is reachable and how authentication is enforced on the SetWan3Settings path. Patch confidence is 0/4 — no patch evidence from any tracked source — and the EPSS score is 0.00473 (39.7th percentile), indicating low modeled near-term exploitation probability, though EPSS does not account for targeted attacks against specific device models.

Detection Guidance

Sigma Rule

title: D-Link DIR-878 WAN Settings Stack Buffer Overflow Attempt (CVE-2026-90693)
id: 4c1f2e7a-9d3b-4f5e-a6c2-7e8b1d0f9a34
status: experimental
description: Detects exploitation attempts targeting the SetWan3Settings function in D-Link DIR-878 firmware 120B05 via oversized Primary/Secondary parameters.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90693
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: dlink
detection:
  selection_uri:
    cs-uri-stem|contains:
      - 'SetWan3Settings'
      - 'wan'
  selection_params:
    cs-uri-query|contains:
      - 'Primary='
      - 'Secondary='
  selection_length:
    cs-uri-query|re: '(Primary|Secondary)=.{256,}'
  condition: selection_uri and (selection_params or selection_length)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrative configuration changes with unusually long values
level: high

YARA Rule

rule CVE_2026_90693_DLink_DIR878_SetWan3Settings_Overflow
{
    meta:
        description = "Detects references to the vulnerable SetWan3Settings WAN handler in D-Link DIR-878 firmware 120B05 samples"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90693"
        cve = "CVE-2026-90693"
        date = "2026-01-01"

    strings:
        $fn = "SetWan3Settings" ascii wide
        $p1 = "Primary" ascii wide
        $p2 = "Secondary" ascii wide
        $model = "DIR-878" ascii wide

    condition:
        $fn and ($p1 or $p2) and $model
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90693 D-Link DIR-878 SetWan3Settings stack buffer overflow attempt"; flow:established,to_server; http.uri; content:"SetWan3Settings"; nocase; http.uri; content:"Primary="; nocase; pcre:"/(Primary|Secondary)=[^&\s]{256,}/i"; reference:cve,CVE-2026-90693; classtype:attempted-admin; sid:9069301; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and url.path : "*SetWan3Settings*"]
  [network where network.protocol == "http" and url.query : ("*Primary=*" or "*Secondary=*") and length(url.query) > 255]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri, url, cs_uri)
| where match(uri, "(?i)SetWan3Settings")
| eval query_len = len(coalesce(uri_query, query_string, ""))
| where query_len > 255 OR match(coalesce(uri_query, query_string, ""), "(?i)(Primary|Secondary)=.{256,}")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,dlink,cve-2026-90693,">
  <rule id="906930" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>SetWan3Settings</url>
    <regex type="pcre2">(?i)(Primary|Secondary)=.{256,}</regex>
    <description>CVE-2026-90693: D-Link DIR-878 SetWan3Settings stack buffer overflow attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Do not expose the D-Link DIR-878 management interface to the internet. Restrict administrative access to a trusted management VLAN or localhost only.
   • Disable remote management / WAN-side administration features if present, and disable UPnP and any cloud/remote-access helpers not strictly required.
   • Enforce strong, unique administrative credentials and, where supported, restrict the management plane by source IP.
   • Because the vulnerable component is a WAN Settings handler, treat any router at firmware 120B05 as potentially compromiseable by any actor with management-plane reachability.

2. Patch/upgrade steps.

   • No vendor patch is available as of this report. Check D-Link's official support portal for the DIR-878 product page and monitor for a firmware release above 120B05.
   • Since no fixed version is confirmed, do not assume any newer build resolves CVE-2026-90693 without explicit vendor confirmation referencing the CVE.
   • If the device is end-of-support or no fix materializes, plan replacement with a supported router model.

3. Long-term hardening.

   • Maintain an inventory of edge devices and their firmware versions; track end-of-support dates.
   • Adopt network segmentation so that compromise of one edge router does not grant direct access to internal segments.
   • Deploy network monitoring (as in the detection rules above) on management-plane traffic to catch exploitation attempts.
   • Monitor the CVE record and D-Link advisories for patch availability, and re-evaluate risk when EPSS or exploit availability changes.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90693
• MITRE CWE-119: https://cwe.mitre.org/data/definitions/119.html
• D-Link USA support / security advisories: https://supportannouncement.us.dlink.com/
• FIRST EPSS: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-90693, and the CVE is not listed in CISA KEV. No threat actor campaigns or exploit-in-the-wild evidence have been identified in the provided data.