CVE-2026-90692

A stack-based buffer overflow exists in the SetDynamicDNSIPv6Settings function of the Dynamic DNS IPv6 Settings component in D-Link DIR-878 routers running firmware 120B05. A remote attacker triggers it by supplying an oversized IPv6Address or Hostname argument to the affected management function, which the CVSS 4.0 vector indicates requires only low (likely authenticated-user level) privileges and no user interaction. Successful exploitation can overwrite stack memory, allowing the attacker to crash the device or potentially execute arbitrary code and fully compromise the router, with high impact to confidentiality, integrity, and availability. Home users and small offices running the DIR-878 on firmware 120B05 are the affected population. No public proof of concept is known and the flaw is not in CISA's KEV catalog, so exploitation status is none known.

What to do: Check D-Link's support site for a firmware update for the DIR-878 and apply it if one is available. If the device is end-of-life with no patch, disable remote/WAN administration so the management interface is reachable only from the LAN, and set a strong unique admin password since the attack path requires low privileges. Given the critical severity and the router's age, plan to replace unpatchable units with a supported model.