D-Link DIR-823G CVE-2026-90680

Exploitation requires the ability to reach the router's HNAP1 web interface and send a SetStaticRouteSettings request; the CVSS PR:L indicates a privilege/authentication requirement, so the realistic prerequisite is a valid administrative session or working credentials (default or weak credentials suffice on many SOHO units). Limiting factors: the device must have its management interface reachable by the attacker - LAN-side by default, or internet-facing only if remote/WAN management is explicitly enabled - and only the specific end-of-life DIR-823G firmware (1.0.2B05_20181207 and code-identical builds) is confirmed vulnerable. No user interaction is required (UI:N), and attack complexity is low (AC:L).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, all impacts High) scores 9.4 and reflects a network-reachable, low-complexity flaw that nonetheless requires some privilege (PR:L) - consistent with HNAP endpoints that typically need authentication or at least a valid session. That authentication gate is the main mitigating factor: pre-auth exploitation is not established from the data, so the realistic threat is an authenticated LAN user, an attacker with default/weak credentials, or one chaining a separate auth-bypass. Public exploit code exists via VulDB and the Amalll-Sec GitHub advisory, but there is no CISA KEV listing and no EPSS score in the input, so this reads as a disclosed, PoC-backed issue rather than confirmed mass exploitation. Because the DIR-823G is an end-of-life consumer router unlikely to receive a fix, exposure is driven by whether the management interface is reachable and whether WAN-side HNAP is enabled; any operator still running these devices should treat unpatched, internet-exposed units as urgent and prioritize replacement or network isolation.

An attacker with access to the router's web interface - an authenticated LAN user, or a remote attacker where WAN management is enabled and credentials are weak or default - sends a crafted HNAP1 SetStaticRouteSettings SOAP request with an overlong PAddress, SubnetMask, or Gateway value. The oversized string overflows the fixed stack buffer via strcpy, overwriting the saved return address to crash the device or execute attacker-controlled code. Public PoC/exploit material is referenced by VulDB and the Amalll-Sec GitHub advisory.