CVE-2026-90880

Executive Summary

CVE-2026-90880 is a command injection vulnerability in the D-Link DSL-3782 router firmware (build dated 2016-07-28). A manipulation of the Addr argument handled by the system function reachable through /cgi-bin/New_GUI/Set/Diagnostics.asp (component: Diagnostics) allows an attacker to inject operating-system commands that execute on the device. The attack is network-reachable and a public exploit has been released, but the vulnerability requires authentication (PR:L, CVSS 7.4), meaning the attacker must first hold valid credentials or chain this with an authentication bypass. The device is end-of-life and no patch has been identified from any tracked source, making credential-hardening and network exposure reduction the primary defenses.

Technical Analysis

The vulnerability class is OS command injection (CWE-74, Improper Neutralization of Special Elements; the injection specifically targets the command shell). The NVD description states that the flaw "affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics," and that "performing a manipulation of the argument Addr results in command injection."

Mechanism, at the class level: the Diagnostics web component accepts a user-supplied address value (Addr) — typically a target host used for a diagnostic utility such as ping or traceroute — and passes it into a shell execution routine (the system function). When that value is concatenated into a command string without proper neutralization of shell metacharacters (e.g., ;, |, &&, `, $()), an attacker can break out of the intended diagnostic command and append arbitrary OS commands that the web server process executes with its own privileges. On embedded router firmware, that process typically runs as a privileged account, so successful injection yields command execution in the device's operating system context.

Attack surface: the Diagnostics CGI endpoint exposed by the router's web management interface. The CVSS scope change (S:C) indicates the compromised component (the CGI/web process) impacts resources beyond its own security scope — consistent with crossing from the web application into the underlying host OS. The attack vector is Network (AV:N) and no user interaction is required (UI:N), so the exploit can be triggered by a crafted HTTP request. The Privileges Required value of Low (PR:L) means the request must be authenticated.

No public PoC code, Nuclei template, or exploit repository content was provided in the dataset, and the CNA title is empty. Accordingly, this report deliberately does not assert specific payload strings, parameter encodings, or code fragments beyond what the description states verbatim.

Exploitation Scenarios

The following chain is derived strictly from the NVD description. No public PoC was supplied in the dataset; the exploitation flow is inferred from the command-injection vulnerability class and the identified endpoint.

1. Reconnaissance / target identification. The attacker identifies an internet- or LAN-exposed D-Link DSL-3782 management interface running the affected 2016-07-28 firmware. Discovery can be performed with internet-wide scanning using the Shodan dorks above or by scanning internal networks for the device web UI.

2. Authentication. Because the CVSS vector specifies PR:L, the attacker must possess valid credentials (default, reused, or previously obtained). This step is a precondition, not a vulnerability of this CVE. It may be satisfied by default credentials, credential stuffing, or a separate authentication bypass.

3. Triggering the flaw. The attacker sends a crafted HTTP request to the Diagnostics component at /cgi-bin/New_GUI/Set/Diagnostics.asp, supplying a malicious value in the Addr argument. The Diagnostics handler passes Addr into the system function, where shell metacharacters in the value cause the intended diagnostic command to be terminated and attacker-controlled commands to be appended and executed.

4. Payload / execution. Execution occurs in the context of the web/CGI process on the device OS. At the vulnerability-class level, this permits arbitrary command execution — for example, commands that read or alter router configuration, modify firewall/NAT rules, or establish outbound connectivity. No specific payload is asserted here because none is provided in the source data.

5. Post-exploitation impact. Per the CVSS vector, the confidentiality, integrity, and availability impacts are each Low (C:L/I:L/A:L) with a Scope change. In practice an attacker with command execution on a router can pivot into the internal network, intercept or redirect traffic, and persist. The public availability of an exploit ("the exploit has been released to the public and may be used for attacks") increases the likelihood of opportunistic exploitation.

Impact Assessment

Business impact is concentrated at the network edge. The DSL-3782 is an end-of-life consumer/SOHO router frequently deployed as the boundary device for small offices and remote/home workers. Command execution on that device undermines the confidentiality, integrity, and availability of all traffic traversing it, and provides a foothold for lateral movement into the protected network. The scope change (S:C) reflects that the impact can extend beyond the web application to the host operating system.

CVSS 3.1 base score: 7.4 (High). Subscores: AV:N (remotely reachable), AC:L (no special conditions), PR:L (credentials required), UI:N (no user interaction), S:C (scope change), C:L / I:L / A:L (partial loss of each). EPSS is 0.01044, placing the CVE at the 62.3rd percentile of exploited CVEs — moderate predicted exploitation likelihood, tempered by the authentication requirement. The CVE is not listed in CISA KEV and carries a patch confidence of 0/4: no vendor fix has been identified, so the affected population remains permanently exposed until devices are replaced or isolated.

Blast radius: any DSL-3782 running the affected firmware that exposes its management interface to an untrusted network, plus every host behind it, plus any site-to-site or VPN traffic terminated by the device.

Detection Guidance

Because the exact injected payload is unknown, the detection content below targets the vulnerable endpoint, the Diagnostics function, and shell-metacharacter patterns in the Addr argument. These rules should be tuned against the device's legitimate diagnostic traffic to reduce false positives.

Sigma Rule

title: D-Link DSL-3782 Diagnostics Command Injection (CVE-2026-90880)
id: 3f9c1a72-8e4b-4d21-9a55-7c1e2b6d0f88
status: experimental
description: Detects HTTP requests to the D-Link DSL-3782 Diagnostics CGI with shell metacharacters in the Addr argument, indicating OS command injection (CVE-2026-90880).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90880
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/cgi-bin/New_GUI/Set/Diagnostics.asp'
  selection_payload:
    cs-uri-query|contains:
      - 'Addr='
    cs-uri-query|re: '(?i)(Addr=[^&]*(%3b|;|%7c|\||%26%26|&&|`|\$\(|%60|%24%28))'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate diagnostics addresses containing unusual but benign characters (rare)
level: high

YARA Rule

rule CVE_2026_90880_DLink_DSL3782_CommandInjection
{
    meta:
        description = "Detects requests or captured traffic referencing the D-Link DSL-3782 Diagnostics endpoint associated with CVE-2026-90880"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90880"
        date = "2026-01-01"
        cve = "CVE-2026-90880"

    strings:
        $endpoint = "/cgi-bin/New_GUI/Set/Diagnostics.asp" ascii nocase
        $param    = "Addr=" ascii nocase
        $m1 = ";" ascii
        $m2 = "|" ascii
        $m3 = "&&" ascii
        $m4 = "$(" ascii
        $m5 = "`" ascii
        $enc_m1 = "%3b" ascii nocase
        $enc_m2 = "%7c" ascii nocase
        $enc_m3 = "%26%26" ascii nocase
        $enc_m4 = "%24%28" ascii nocase
        $enc_m5 = "%60" ascii nocase

    condition:
        $endpoint and $param and 1 of ($m*) or $endpoint and $param and 1 of ($enc_m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90880 D-Link DSL-3782 Diagnostics Addr Command Injection Attempt"; flow:established,to_server; http.uri; content:"/cgi-bin/New_GUI/Set/Diagnostics.asp"; http.uri; content:"Addr="; pcre:"/Addr=[^&]*(%3b|%7c|%26%26|%24%28|%60|;|\||&&|\$\(|`)/iU"; reference:cve,CVE-2026-90880; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90880; classtype:web-application-attack; sid:9088026; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and url.path : "/cgi-bin/New_GUI/Set/Diagnostics.asp" and url.query : "Addr=*"]
  [network where network.protocol == "http" and url.path : "/cgi-bin/New_GUI/Set/Diagnostics.asp" and url.query regex "Addr=.*(%3b|%7c|%26%26|%24%28|%60|;|\\||&&|\\$\\(|`).*"]

Splunk SPL Query

index=web sourcetype=access_common OR sourcetype=stream:http
| eval uri=coalesce(uri, url, c_uri, cs_uri_stem)
| eval query=coalesce(uri_query, cs_uri_query, url_query, c_uri_query)
| where like(uri, "%/cgi-bin/New_GUI/Set/Diagnostics.asp%")
| where like(query, "%Addr=%")
| regex query="Addr=[^&]*(%3b|%7c|%26%26|%24%28|%60|;|\||&&|\$\(|`)"
| stats count values(query) as payloads by src_ip, dest_ip
| sort - count

Wazuh OSSEC Rule

<group name="web,dlink,cve-2026-90880,">
  <rule id="908802" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/cgi-bin/New_GUI/Set/Diagnostics.asp</url>
    <regex>Addr=[^&]*(%3b|%7c|%26%26|%24%28|%60|;|\||&&|\$\(|`)</regex>
    <description>CVE-2026-90880: Possible D-Link DSL-3782 Diagnostics command injection via Addr argument</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version mapping was supplied in the source data.

1. Immediate mitigations:

• Remove the DSL-3782 from internet exposure. Never expose the web management interface (/cgi-bin/New_GUI/...) directly to untrusted networks.
• Change all default and weak credentials immediately; CVE-2026-90880 requires Low privileges (PR:L), so strong unique passwords directly raise the exploitation bar.
• Restrict management access to a trusted LAN/VLAN and disable remote management if the firmware permits.
• Deploy the Sigma/Suricata/Wazuh detections above and alert on requests to /cgi-bin/New_GUI/Set/Diagnostics.asp containing shell metacharacters in Addr.
• Because the device is end-of-life (affected firmware from 2016), treat it as unsupportable and plan replacement.

2. Patch/upgrade steps:

• No patched firmware version has been identified for this CVE. Check the D-Link support site for any security advisory or last-available firmware for the DSL-3782, but assume no fix exists.
• Where no fix is offered, replace the device with a supported router that receives security updates.

3. Long-term hardening:

• Maintain a hardware/firmware lifecycle inventory so end-of-life edge devices are identified before they are exploited.
• Enforce network segmentation so a compromised router cannot reach internal management planes.
• Monitor edge devices for anomalous outbound connections consistent with command-execution post-exploitation.
• Subscribe to vendor PSIRT feeds and CISA advisories for DSL-3782 and related D-Link models.

References

• NVD — CVE-2026-90880: https://nvd.nist.gov/vuln/detail/CVE-2026-90880
• CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• D-Link Security Advisories (vendor PSIRT): https://www.dlink.com/en/security-bulletin
• CISA Known Exploited Vulnerabilities Catalog (check status for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: The NVD description states the exploit "has been released to the public and may be used for attacks." No specific threat actor campaign, malware family, or KEV listing was provided in the source data; CVE-2026-90880 is NOT in CISA KEV. Because exploitation requires credentials (PR:L), mass opportunistic abuse is constrained to devices with default or compromised credentials.