External risk intelligence

D-Link DIR-823G HNAP1 Stack Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-90680

The vulnerability affects a D-Link router management interface (HNAP1). Router administration interfaces, while often intended for internal network management, are frequently exposed to the public internet in home and small office deployments, making them a common target for remote access.

Memory Corruption

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in D-Link routers, specifically within the HNAP1 component. This flaw allows for remote exploitation, potentially leading to a complete compromise of the affected device. The main concern at this time is to confirm if this technology is in use and assess any potential exposure.

Remote attackers can overflow router memory.
It impacts network infrastructure and security.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can remotely trigger this vulnerability by targeting the HNAP1 component's `SetStaticRouteSettings` function. By manipulating specific arguments within the function, an attacker can cause a stack-based buffer overflow, potentially leading to significant system compromise.

Unauthenticated network access required.
Triggered by manipulating HNAP1 arguments.
Risk of critical system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to cause a stack-based buffer overflow in the HNAP1 component by manipulating specific network settings. When supported by the advisory, this could impact the device's availability and potentially lead to unauthorized access or control of the router.

Router management interface could be affected.
Remote, unauthenticated manipulation of settings.
Disruption of service or unauthorized control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The security flaw in D-Link DIR-823G routers, specifically within the HNAP1 component, impacts remote access to network configurations. Infrastructure and network security teams are typically responsible for managing and securing these devices. The immediate practical step is to identify all instances of this router model within the environment, assess their internet reachability and business criticality, and then determine the accountable owner for remediation planning based on the identified risk.

Infrastructure teams own the issue.
Verify internet exposure and device criticality.
Plan vendor-coordinated firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DIR-823G router?

The D-Link DIR-823G is a networking device used to manage home or small office internet connectivity. It includes a specialized component called HNAP1, or Home Network Administration Protocol, which is designed to allow administrators to configure router settings remotely through a web-based interface.

What does CVE-2026-90680 mean by stack-based buffer overflow?

This is a memory corruption weakness, classified as CWE-121. It occurs when a program tries to store more data in a specific memory area, known as the stack, than it can hold. In this CVE, the HNAP1 component does not properly check the length of input data, allowing that extra data to overwrite adjacent memory, which can lead to system instability or unauthorized control.

How is this buffer overflow triggered?

An attacker triggers this by sending specially crafted input to the SetStaticRouteSettings function within the HNAP1 interface. Specifically, they must provide manipulated values for parameters like the network address, subnet mask, or gateway. Simply accessing the management interface or performing legitimate configuration changes does not trigger this flaw.

Do I need to worry about this if my router is only used internally?

Halo Surface Signal notes that while HNAP1 is often for internal management, these interfaces are frequently exposed to the internet in many deployments. You should verify if your device's management interface is reachable from the public internet. If it is, the risk of remote, unauthenticated exploitation is significantly higher.

What is the first step I should take for this vulnerability?

Begin by auditing your infrastructure to identify if any D-Link DIR-823G routers are in use. Once identified, determine if they are accessible from the internet and establish who is responsible for managing them. Prioritize these devices for risk assessment and prepare to coordinate with the vendor for official firmware updates once available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.