EUVD-2026-77317
GHSA-vg87-cmh7-p8wr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router admin interface on LAN/WAN
-
DeliveryAuthenticate with admin credentials
-
ExploitSend SetWan3Settings request with oversized Primary/Secondary
-
ExecutionOverflow stack buffer, overwrite return address
-
PersistExecute code or crash router
-
ImpactPivot/intercept traffic behind device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the DIR-878's web administration interface and valid administrative authentication (CVSS PR:L) to invoke the SetWan3Settings action of the WAN Settings component; the attacker then supplies an oversized Primary or Secondary WAN argument to overflow the stack buffer. No user interaction is needed (UI:N) and complexity is low (AC:L), but the authentication requirement and the fact that admin interfaces are normally LAN-only (unless remote management is enabled) are the primary limiting factors - a purely unauthenticated internet attacker cannot reach it in a default configuration. Only firmware 120B05 on the DIR-878 is named. |
| Impact | The CVSS 4.0 base of 9.4 (AV:N/AC:L/AT:N/PR:L/UI:N with high vulnerable- and subsequent-system impact) reflects a low-complexity network-reachable overflow, but the PR:L requirement means the attacker must be authenticated to the router's admin interface - a meaningful limiter that the headline score understates. No EPSS value was supplied and the CVE is not in CISA KEV, so there is no evidence of active or automated exploitation; risk is currently theoretical-to-targeted. The subsequent-system impact set to High (SC:H/SI:H/SA:H) in the input is arguably overstated, since the vulnerable and impacted system is the router itself rather than a distinct downstream system. Overall this is a genuine memory-corruption bug on an aging/likely end-of-life consumer device, but real-world priority is moderated by the authentication requirement and absence of confirmed exploitation. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed the router's admin credentials (or rides an authenticated session) sends a crafted SetWan3Settings request with an overly long Primary or Secondary WAN field, overflowing the stack buffer to crash the device or execute attacker-supplied code as the router's web process. From there the attacker can pivot to intercept or redirect all traffic behind the router. A public technical advisory describing the flaw exists on GitHub, but no weaponized exploit is confirmed at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis; DIR-878 is a legacy model that may have reached end-of-support, so a fixed firmware version may never ship - verify current status on the D-Link support site (https://www.dlink.com/) and monitor D-Link security announcements for a firmware update, applying it immediately if released. As compensating controls, restrict access to the router's administration interface to trusted LAN hosts only and disable any remote/WAN-side management (this blocks off-LAN attackers but does not stop a malicious authenticated LAN user or a hijacked admin session), change default admin credentials and enforce a strong password to raise the bar on the required PR:L authentication, and segment/quarantine the device on an isolated management VLAN. Where feasible for high-assurance environments, replace the end-of-life DIR-878 with a currently supported router, since the trade-off of relying solely on access restrictions is that any credential compromise re-exposes the overflow.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The DIR-878 is a consumer dual-band Wi-Fi router whose administrative HTTP(S)/HNAP-style interface exposes WAN configuration actions. SetWan3Settings processes WAN parameters, and the Primary/Secondary arguments (commonly primary/secondary DNS or gateway addresses) are copied into a fixed-size stack buffer without bounds checking, the classic CWE-121 stack-based buffer overflow. On MIPS/ARM SOHO firmware built with BusyBox/uClibc and typically no stack canaries or ASLR, overflowing a stack buffer can overwrite the saved return address and redirect execution, making these routers frequently exploitable for full control rather than mere denial of service. The single CPE cpe:2.3:a:d-link:dir-878 identifies the affected product; the flaw is in vendor firmware, not a shared library.
Know when Dir 878 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable, low-complexity overflow but requires router admin authentication (PR:L); memory corruption on the router yields high C/I/A with scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.
Articles & Coverage 1
Executive ViewAI
The D-Link DIR-878 wireless router (firmware 120B05) contains a critical stack-based buffer overflow in its configuration interface that enables complete device compromise and code execution. A compromised router becomes a network pivot point allowing attackers to intercept all traffic, inject content, and establish persistent internal network access, threatening every user and device connected to that network.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative console access to a dedicated secure management network, implement IP-based filtering for all management traffic, deploy network-based intrusion detection to monitor for exploitation attempts targeting the SetWan3Settings handler, disable WAN configuration features if not operationally required, and expedite replacement with alternative router models.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB