Description

A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of the argument IPv6Address/Hostname results in stack-based buffer overflow. The attack may be launched remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-14T07:17:25.263Z",
  "pubdate": "2026-09-14T07:17:25.263Z",
  "executiveSummary": "This vulnerability involves a stack-based buffer overflow in the D-Link DIR-878 (firmware 120B05), specifically within the 'SetDynamicDNSIPv6Settings' function of the Dynamic DNS IPv6 Settings component.\nThe flaw stems from improper boundary checking when processing the 'IPv6Address/Hostname' argument, allowing a remote attacker to trigger memory corruption.\nSuccessful exploitation of this vulnerability enables arbitrary code execution on the target device, potentially leading to a full compromise of the router.\nThe attack vector is remote, meaning a threat actor can interact with the vulnerable management interface over the network to execute malicious payloads without physical access.\nThe primary risk implications include unauthorized system control, potential persistence, and the ability to intercept or redirect network traffic passing through the affected hardware.\nDue to the nature of stack-based overflows, the integrity and availability of the router are severely compromised, and elevated privileges are typically achieved upon successful exploitation.",
  "technicalDetails": "The vulnerability resides within the binary responsible for handling Dynamic DNS configuration requests on the D-Link DIR-878 firmware version 120B05. The core issue is an insecure implementation of data handling within the 'SetDynamicDNSIPv6Settings' function. During the processing of the 'IPv6Address/Hostname' input parameter, the application fails to perform adequate bounds checking before copying the user-provided input into a fixed-length stack-based buffer.\nWhen an attacker supplies a specially crafted string that exceeds the designated memory allocation for the buffer, a stack-based buffer overflow occurs. This memory corruption overwrites adjacent data on the call stack, including the saved return address or other critical control flow pointers. By precisely controlling the overflow content, an attacker can redirect the function's return pointer to a malicious payload injected earlier into the stack, or point the instruction pointer (IP/PC) to a ROP (Return Oriented Programming) chain if non-executable memory protections like DEP are active.\nThe attack flow initiates when the remote attacker transmits a malicious HTTP request or equivalent administrative command containing a long 'IPv6Address/Hostname' string. The web server or backend management process parses this input via the 'SetDynamicDNSIPv6Settings' routine. As the function proceeds to process the oversized argument using insecure functions (such as 'strcpy' or 'sprintf'), the stack frame is corrupted. Once the function attempts to return, the CPU pulls the malicious address provided by the attacker from the corrupted stack, shifting execution to the attacker-supplied code.\nThis vulnerability is critical because it bypasses standard input validation layers typically found in router management interfaces. The 'SetDynamicDNSIPv6Settings' component is exposed to the network, facilitating remote exploitation. Post-exploitation, the attacker operates with the privileges of the service process, which, in embedded firmware, often runs with root-level access. This allows for arbitrary code execution, such as installing backdoors, modifying DNS settings, or utilizing the device as a pivot point within the local area network (LAN). Because this is a memory-corruption vulnerability, the attacker does not necessarily require valid administrative credentials if the interface lacks proper pre-authentication filtering, making the device highly susceptible to automated exploitation attempts targeting exposed administrative services."
}