Description

A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-14T08:16:35.673Z",
  "pubdate": "2026-09-14T08:16:35.673Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the WAN Settings component of the D-Link DIR-878 router, specifically within the SetWan3Settings function.\nThis flaw allows a remote, unauthenticated attacker to inject malicious data into the affected function, leading to potential memory corruption.\nThe vulnerability resides in the improper handling of the 'Primary' and 'Secondary' input arguments, which lack adequate boundary validation before being copied into a fixed-size stack buffer.\nSuccessful exploitation of this flaw can result in the execution of arbitrary code with the privileges of the underlying service or trigger a denial-of-service (DoS) condition by crashing the process.\nGiven the nature of the interface, the vulnerability is reachable over the network, posing a significant risk to the integrity and availability of the device.\nAffected users are at risk of unauthorized system manipulation, and current defensive posture requires restricting access to the web management interface.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located within the SetWan3Settings function of the D-Link DIR-878 (firmware 120B05).\nThe root cause is the failure of the application to implement length checks or bounds verification when processing inputs provided via the 'Primary' and 'Secondary' parameters of the WAN configuration interface.\nWhen a user submits these parameters, the device's web management binary copies the provided input string into a pre-allocated stack buffer of insufficient size.\nBecause the function uses unsafe memory copy operations (likely variants of strcpy or sprintf that do not truncate inputs based on the destination buffer size), an attacker can provide an input string that exceeds the buffer boundaries.\nBy exceeding the memory allocated for the local stack frame, the input data overwrites critical control structures, most notably the saved return address on the stack.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious HTTP POST request targeting the endpoint responsible for WAN settings. 2) The request includes an oversized 'Primary' or 'Secondary' parameter payload designed to reach the stack overflow point. 3) Upon processing, the SetWan3Settings function performs the unsafe copy operation, overwriting the stack frame.\n4) The function continues execution, and when it attempts to return to the calling function, the processor jumps to an address determined by the corrupted stack data, enabling control-flow hijacking.\nIf the attacker successfully injects and redirects execution to shellcode—either stored within the overflowed buffer or elsewhere in memory—they can achieve remote code execution (RCE).\nAlternatively, supplying a malformed, excessively large string that results in a segmentation fault will cause the management service to crash, creating a persistent denial-of-service condition that requires a hard power cycle of the router to recover.\nThis vulnerability is particularly dangerous as it is reachable via the remote web management interface, exposing the device to external threats if the WAN management or the LAN-side interface is accessible to an adversary."
}