Executive Summary
A critical stack-based buffer overflow (CVE-2026-90680) has been disclosed in the D-Link DIR-823G wireless router, affecting firmware version 1.0.2B05_20181207. The flaw carries a CVSS score of 9.9 and requires no authentication, no user interaction, and can be triggered remotely over the network — making it a high-value target for botnet operators and IoT-focused threat actors.
CVSS Score: 9.9 (Critical)
The vulnerability lives in the router's HNAP1 (Home Network Administration Protocol) interface, specifically the /HNAP1/SetStaticRouteSettings endpoint. The endpoint copies the PAddress, SubnetMask, and Gateway request parameters into a fixed-size stack buffer using the unsafe strcpy() function, with no bounds checking on the input length.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-90680 |
| CVSS Score | 9.9 (Critical) |
| Type | Stack-Based Buffer Overflow (CWE-121) |
| Attack Vector | Network (no authentication required) |
| Privileges Required | None |
| User Interaction | None |
| Component | HNAP1 /HNAP1/SetStaticRouteSettings |
| Vulnerable Function | strcpy() |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| D-Link DIR-823G | 1.0.2B05_20181207 and earlier | Not yet published |
Attack Vector
1. Attacker identifies a D-Link DIR-823G exposing the HNAP1 management interface
2. Attacker sends a crafted HNAP1 request to /HNAP1/SetStaticRouteSettings
3. The PAddress, SubnetMask, or Gateway argument contains an oversized string
4. strcpy() copies the value into a fixed stack buffer with no length check
5. The overflow corrupts adjacent stack memory, including the saved return address
6. Crafted overflow data redirects execution to attacker-controlled codeImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Remote Code Execution | Arbitrary code execution in the router's firmware context |
| Denial of Service | Router crash/reboot from a malformed request |
| Botnet Recruitment | Compromised routers absorbed into IoT DDoS botnets |
| Network Pivoting | Router used as a foothold into the local network |
| Traffic Interception | Attacker-controlled routing/DNS manipulation |
Why This Matters
Unauthenticated, network-reachable memory-corruption bugs in consumer router firmware are a recurring favorite for IoT botnet operators — this is the same bug class (CWE-121, unsafe strcpy() in an HNAP endpoint) that has powered past Mirai-derived campaigns against D-Link hardware. No public proof-of-concept has been observed yet, but the low attack complexity and lack of authentication make weaponization straightforward.
Immediate Remediation
Step 1: Check for a Firmware Update
D-Link has not yet published a patched firmware build for this specific CVE at the time of writing. Check the vendor's support page for DIR-823G regularly:
https://support.dlink.comStep 2: Restrict Management Access
- Disable remote/WAN management on the device if enabled
- Restrict HNAP1 access to trusted LAN clients only, via firewall rules if the device supports them
- Segment IoT and consumer networking gear onto an isolated VLAN away from critical systems
Step 3: Consider Retirement
The DIR-823G is an older consumer router line. If a vendor patch is not issued promptly, replacing end-of-life hardware with an actively supported model is the most durable fix.
Detection Indicators
| Indicator | Description |
|---|---|
Oversized PAddress/SubnetMask/Gateway values in HNAP1 requests | Exploitation attempt |
| Unexpected router reboots or crash loops | Possible failed exploitation |
| Anomalous outbound traffic from the router | Possible successful compromise |
Requests to /HNAP1/SetStaticRouteSettings from WAN-facing IPs | Remote exploitation attempt |