External risk intelligence

D-Link DIR-878 Stack Buffer Overflow in WAN Settings

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-90693

The vulnerability affects a home router's WAN settings. WAN configuration interfaces on routers are typically designed to handle external network traffic, making this component a common part of the edge-facing attack surface in standard residential deployments.

Memory Corruption

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in D-Link DIR-878 routers, specifically within the WAN Settings component. This flaw could allow remote attackers to execute malicious code due to a stack-based buffer overflow. The potential for remote exploitation makes it important to understand the scope of affected devices.

Flaw in router settings allows remote code execution.
Routers are critical infrastructure for network security.
Confirm relevance and exposure for affected D-Link devices.

Attack Path

How an attacker could exploit the issue

An attacker with network access and some level of authentication could target the router's WAN settings. By manipulating a specific argument within the `SetWan3Settings` function, they could trigger a stack-based buffer overflow, potentially leading to a compromise of the device.

Requires network access and authenticated user.
Triggers stack buffer overflow in WAN settings.
Risks unauthorized access and device control.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow in the WAN Settings component could allow an unauthenticated remote attacker to execute arbitrary code when manipulating specific arguments. This could affect the router's core functionality and potentially expose network traffic when supported by the advisory.

Router configuration and network access.
Remote manipulation of WAN settings.
Compromised device and network traffic.

Operational Fix

Recommended remediation, mitigation, and detection steps

The D-Link DIR-878 router's WAN Settings component is susceptible to a critical buffer overflow vulnerability. This could allow remote attackers to gain control of the device. The first practical step is to identify all instances of this router model, confirm their network exposure and business criticality, and then engage the accountable owner to prioritize and plan remediation.

Identify affected devices and owners.
Verify network exposure and criticality.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DIR-878 router?

The D-Link DIR-878 is a consumer-grade wireless router designed to manage home or small office network traffic. It acts as the gateway between your local devices and the internet, handling tasks like traffic routing, Wi-Fi connectivity, and wide area network (WAN) configurations to ensure your devices communicate reliably with the outside world.

What does this stack-based buffer overflow mean in CVE-2026-90693?

This vulnerability falls under the category of Memory Corruption, specifically focusing on how the device handles incoming data. A stack-based buffer overflow happens when the software receives more data than it was designed to store in a specific memory area. Because the system fails to check the size of the input, the excess data can overwrite adjacent memory, which may allow an attacker to disrupt device operations or execute unauthorized commands.

How is the SetWan3Settings function triggered?

The flaw is triggered when an attacker sends specifically crafted input to the SetWan3Settings function within the router's WAN configuration interface. The attack requires the user to already have network access and authentication. Simply visiting the router's interface or browsing the web does not trigger this issue; it requires a targeted, intentional interaction with that specific configuration command.

Is my device vulnerable according to Halo Surface Signal?

Halo Surface Signal identifies this as an external threat because the affected WAN settings are part of the router's edge-facing interface. Since this component is designed to interact with external network traffic to maintain connectivity, it resides on your network perimeter. Devices reachable from the internet face a higher risk compared to those strictly isolated within an internal network.

What are the first steps to secure my D-Link router?

Begin by creating an inventory of all your networking hardware to confirm if you are running the DIR-878 model. Once identified, evaluate whether the device is internet-facing and determine who is responsible for its management. Prioritize restricting access to the administrative configuration pages to trusted local devices only, and seek official guidance or software updates from the manufacturer to address the underlying vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.