CVE-2026-90693

A stack-based buffer overflow (CWE-121/119) exists in the SetWan3Settings function of the WAN Settings component in D-Link DIR-878 routers running firmware 120B05. A remote attacker who has authenticated with low privileges can trigger the flaw by supplying an oversized value in the Primary/Secondary arguments of a WAN settings request, overwriting stack memory. Successful exploitation can crash the device or yield arbitrary code execution with full control of the router, enabling interception or manipulation of routed traffic and use of the device as a pivot into the home or small-office network. Only D-Link DIR-878 units on firmware 120B05 are confirmed affected, and the CVSS 4.0 score of 9.4 (critical) reflects high impact on confidentiality, integrity, and availability. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not on the CISA Known Exploited Vulnerabilities list.

What to do: Check D-Link's security advisories for a fixed DIR-878 firmware; if version 120B05 is no longer supported, plan to retire and replace the unit. In the interim, disable remote/WAN-side management, restrict the admin interface to the LAN or a VPN, and change default credentials since exploitation requires low-privilege authentication. Watch for unexplained reboots or unexpected changes to WAN settings, which would indicate tampering.