CVE-2026-90880: D-Link DSL-3782 RCE Vulnerability

CVE-2026-90880 Overview

CVE-2026-90880 is a command injection vulnerability in the D-Link DSL-3782 router (build dated 2016-07-28). The flaw resides in the system function invoked by the /cgi-bin/New_GUI/Set/Diagnostics.asp endpoint within the Diagnostics component. An authenticated attacker can manipulate the Addr argument to inject arbitrary operating system commands. The attack is remotely exploitable over the network, and a public proof-of-concept has been released. The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote attackers with low privileges can inject shell commands through the Diagnostics endpoint, gaining execution on the affected router.

Affected Products

D-Link DSL-3782 router (firmware build 2016-07-28)
/cgi-bin/New_GUI/Set/Diagnostics.asp handler
Diagnostics component Addr parameter

Discovery Timeline

2026-09-15 - CVE-2026-90880 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90880

Vulnerability Analysis

The D-Link DSL-3782 exposes a diagnostics interface through /cgi-bin/New_GUI/Set/Diagnostics.asp. This endpoint accepts an Addr parameter intended to hold a target address for network diagnostic operations such as ping or traceroute. The handler passes the value directly into a system() call without sanitization. An authenticated attacker can append shell metacharacters to Addr and execute arbitrary commands with the privileges of the web server process, typically root on embedded router firmware. Public disclosure includes a proof-of-concept, increasing the likelihood of opportunistic exploitation against exposed devices. Refer to the VulDB vulnerability report for additional details.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream shell interpreter [CWE-74]. The Addr argument is concatenated into a command string and executed by the system library function. No allowlist, escaping, or argument separation is applied before invocation, so shell operators such as ;, |, &&, and backticks alter the command semantics.

Attack Vector

Exploitation requires network access to the router's management interface and valid low-privileged credentials. The attacker submits a crafted HTTP request to the Diagnostics endpoint with an Addr value containing an injected command. The web application invokes system with the tainted string, and the shell executes the injected payload. Because DSL-3782 devices are frequently deployed at the network edge, exposed management interfaces broaden the attack surface. See the public proof-of-concept repository for technical details.

Detection Methods for CVE-2026-90880

Indicators of Compromise

HTTP POST or GET requests to /cgi-bin/New_GUI/Set/Diagnostics.asp containing shell metacharacters (;, |, &, backticks, $()) in the Addr parameter.
Unexpected outbound connections from the router to attacker-controlled infrastructure following diagnostics requests.
Modified or newly created files in writable firmware paths such as /tmp or /var.

Detection Strategies

Inspect web server and router access logs for requests to the Diagnostics endpoint with anomalous Addr values.
Deploy network intrusion detection signatures that flag command injection patterns in HTTP request bodies targeting D-Link CGI paths.
Monitor for spawned processes on the device that are not part of normal diagnostic workflows, such as wget, curl, nc, or sh invoked from the web handler.

Monitoring Recommendations

Forward router syslog and management-plane telemetry to a centralized logging platform for correlation and retention.
Alert on repeated authentication attempts against the DSL-3782 web interface, which often precedes exploitation.
Baseline outbound traffic from the router and alert on new destinations, especially over non-standard ports.

How to Mitigate CVE-2026-90880

Immediate Actions Required

Restrict access to the router's web management interface to trusted management VLANs or specific administrator IP addresses.
Disable remote WAN-side administration if it is not required for operations.
Rotate all administrative credentials on affected DSL-3782 devices and enforce strong, unique passwords.
Audit recent diagnostics activity for signs of exploitation before hardening.

Patch Information

At the time of publication, no vendor patch has been referenced in the enriched CVE data. Consult the D-Link official website for firmware updates and security bulletins for the DSL-3782 platform. Given the 2016-07-28 build date, the device may be end-of-life; consider replacement with a supported model.

Workarounds

Place the router behind a network firewall that blocks inbound access to the HTTP management interface from untrusted networks.
Segment the device onto a dedicated management network with strict access control lists.
If no patch is available and the device cannot be replaced, decommission the DSL-3782 from environments where remote management is required.

bash

# Example: block external access to the router management interface
iptables -A INPUT -p tcp --dport 80 -s <trusted_mgmt_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s <trusted_mgmt_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP