CVE-2026-90680: D-Link DIR-823G Buffer Overflow Vulnerability

CVE-2026-90680 Overview

CVE-2026-90680 is a stack-based buffer overflow in the D-Link DIR-823G router running firmware version 1.0.2B05_20181207. The flaw resides in the strcpy call within the /HNAP1/SetStaticRouteSettings endpoint of the Home Network Administration Protocol (HNAP1) component. Attackers can trigger the overflow by manipulating the PAddress, SubnetMask, or Gateway arguments. The condition is exploitable remotely over the network and maps to CWE-119, improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers with low privileges can corrupt router memory through crafted HNAP1 requests, enabling arbitrary code execution and full compromise of the affected device.

Affected Products

D-Link DIR-823G router
Firmware version 1.0.2B05_20181207
HNAP1 component, SetStaticRouteSettings handler

Discovery Timeline

2026-09-14 - CVE-2026-90680 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90680

Vulnerability Analysis

The DIR-823G HNAP1 interface exposes a SetStaticRouteSettings action that accepts user-supplied routing parameters. The handler passes the PAddress, SubnetMask, and Gateway values directly to strcpy without validating input length. Because strcpy copies until a null terminator, an oversized value overruns the fixed-size stack buffer allocated by the handler. Overwriting adjacent stack data allows attackers to corrupt saved registers and return addresses on MIPS-based D-Link firmware.

Successful exploitation results in control over program flow within the HTTP server process, which typically runs with elevated privileges on the device. This leads to full compromise of the router, including traffic interception, DNS hijacking, and lateral movement into the LAN.

Root Cause

The root cause is missing bounds checking around a legacy strcpy call in the HNAP1 SetStaticRouteSettings request parser. The routine trusts attacker-controllable string parameters extracted from the SOAP request body and copies them onto a stack-allocated buffer of fixed size.

Attack Vector

Exploitation requires network reachability to the router's HNAP1 endpoint and authenticated access at a low privilege level. An attacker sends a crafted SOAP request to /HNAP1/SetStaticRouteSettings with an oversized PAddress, SubnetMask, or Gateway field. No user interaction is required. Refer to the GitHub D-Link Router Advisory and the VulDB CVE-2026-90680 Entry for reproduction details.

Detection Methods for CVE-2026-90680

Indicators of Compromise

Inbound HTTP or HTTPS requests to /HNAP1/SetStaticRouteSettings from untrusted networks or unexpected internal hosts.
SOAP request bodies containing abnormally long PAddress, SubnetMask, or Gateway string values.
Router process crashes, unexpected reboots, or watchdog-triggered restarts of the HNAP web service.
Post-exploitation changes to DNS resolvers, static routes, or administrative credentials on the DIR-823G.

Detection Strategies

Deploy network intrusion detection signatures that flag HNAP1 requests where routing parameter strings exceed expected IPv4 dotted-quad length.
Inspect HTTP request bodies destined for router management interfaces for overflow patterns and non-printable payloads.
Correlate router syslog crash entries with preceding HNAP1 traffic to identify probable exploitation attempts.

Monitoring Recommendations

Log and alert on any external access to router administrative interfaces, including HNAP1 on TCP/80 and TCP/443.
Baseline configuration state of the DIR-823G and alert on unauthorized static route, DNS, or firewall rule modifications.
Monitor DHCP and ARP telemetry inside the LAN for signs of downstream client redirection following a suspected router compromise.

How to Mitigate CVE-2026-90680

Immediate Actions Required

Restrict access to the HNAP1 interface to trusted management hosts only and block WAN-side administrative access.
Change router administrative credentials and rotate any Wi-Fi Protected Access (WPA) pre-shared keys used on the device.
Inventory environments for D-Link DIR-823G units running firmware 1.0.2B05_20181207 and prioritize replacement or isolation.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-90680 at the time of publication. The D-Link DIR-823G has reached end-of-life status in several regions. Consult the D-Link Official Website for regional support advisories and any successor firmware. Where no fix is available, replace the device with a supported model.

Workarounds

Disable HNAP1 functionality on the router if the management interface exposes an option to do so.
Place the router behind an upstream firewall that blocks inbound requests to /HNAP1/ paths from untrusted networks.
Segment the router management VLAN and require VPN access for any administrative connections.
Replace unsupported DIR-823G hardware with a vendor-supported router that receives active firmware updates.

bash

# Example upstream firewall rule to block external HNAP1 access
iptables -I FORWARD -p tcp --dport 80 -d <router_ip> \
  -m string --algo bm --string "/HNAP1/" -j DROP
iptables -I FORWARD -p tcp --dport 443 -d <router_ip> \
  -m string --algo bm --string "/HNAP1/" -j DROP