CVE-2026-90880

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version 2016-07-28

Description A command injection flaw exists in the Diagnostics component of the firmware. The issue occurs because the system does not properly sanitize data on the control level when processing the Addr parameter. A remote attacker can exploit this by manipulating the Addr parameter within the /cgi-bin/New GUI/Set/Diagnostics.asp endpoint, which affects the system() function. This can lead to a compromise of confidentiality, integrity, and availability of the protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /cgi-bin/New GUI/Set/Diagnostics.asp endpoint to minimize the risk of exploitation.