D-Link DIR-882 CVE-2026-90881

Exploitation requires the DIR-882 router's HNAP web interface to be reachable by the attacker, either via WAN-side remote management being enabled (non-default but common misconfiguration) or from within the LAN. No authentication is required (PR:N confirmed by CVSS 4.0 vector). No specific protocol beyond standard HTTP is needed - the /HNAP1/dllog.cgi endpoint is a plain CGI resource. Firmware must be version 20260814 or earlier. The primary limiting factor is network reachability: routers with WAN admin disabled (the default) are not remotely exploitable from the internet, though they remain exploitable from the local network by any connected client.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) scores 5.5, reflecting a network-reachable, zero-complexity, unauthenticated read with limited confidentiality impact. This is an accurate characterization for a consumer router CVE: the impact is bounded to low-sensitivity data disclosure rather than remote code execution or full credential compromise. The E:P supplemental tag confirms a public PoC exists, which meaningfully elevates practical exploitation risk on any internet-exposed device. EPSS data is not provided, but the combination of a public PoC, no authentication required, and the ubiquity of internet-exposed home routers suggests elevated opportunistic exploitation potential. No CISA KEV listing means active exploitation is not confirmed. The primary real-world risk is for DIR-882 units with WAN-accessible administration interfaces, which is a non-default but common misconfiguration. The PoC filename (dlquickvpnsettings) implies VPN credentials or peer configuration could be among the disclosed data, which would elevate actual impact beyond what VC:L alone suggests. No vendor advisory or patch version has been identified in the references.

An attacker scanning the internet for D-Link DIR-882 routers with remote management enabled sends an unauthenticated HTTP request to /HNAP1/dllog.cgi on the device's WAN IP. The CGI binary's main() function processes the request and returns sensitive data - potentially including VPN configuration settings or diagnostic logs - without any credential check. A public PoC on GitHub (limou89/somevul) demonstrates this technique and was available at time of analysis.