A D-Link DIR-878 vulnerability pair reached the national vulnerability database on 14 September 2026, and both records carry a CVSS 3.1 base score of 9.9. That number sits a rounding error below the maximum. Yet the vector string behind it, and the research those records were built on, describe something narrower than a remote takeover of your home network. The router is also more than five years past the end of its support, so no firmware fix is coming. This piece covers what was published, what the score is actually made of, what the underlying research documents, and what a DIR-878 owner should do this week.
What was published, and on what date
Both records appeared on 14 September 2026. CVE-2026-90692 landed first, and CVE-2026-90693 followed about an hour later. Each one names the same device and the same firmware build, a D-Link DIR-878 running 120B05.
The first flaw sits in a function called SetDynamicDNSIPv6Settings, which belongs to the router's Dynamic DNS settings for IPv6. An attacker manipulates the IPv6Address or Hostname argument and overflows a buffer on the stack. The second flaw sits in SetWan3Settings, part of the WAN settings, and the overflow arrives through the primary or secondary DNS fields.
Both are recorded as stack-based buffer overflows under CWE-121, with CWE-119 listed alongside.
The number everyone quotes, and the letters nobody reads
The 9.9 figure is a CVSS 3.1 base score. The vector that produces it reads AV:N, AC:L, PR:L, UI:N, S:C, C:H, I:H, A:H. Two of those letters carry most of the weight.
S:C means Scope Changed. The assessor judged that a successful attack reaches components beyond the vulnerable one, which on a router means the network sitting behind it. Scope Changed on its own lifts a CVSS 3.1 score sharply.
PR:L means Privileges Required is Low. In plain terms, the attacker needs an account on the device before any of this works. That single letter separates a flaw a botnet can spray at the open internet from a flaw that needs a foothold first.
The same records also carry a CVSS 4.0 score of 9.4 on identical facts. Neither number is wrong. They simply weight the same evidence differently, which is a good reason to read the vector instead of the headline.
What "privileges required" means on a home router
On a consumer router, a low-privilege account usually means the web administration login. Getting one is not exotic. Default credentials survive on plenty of installed devices, password reuse is common, and anyone already inside the local network starts much closer than someone on the open internet.
So the honest framing here is conditional. If nobody can reach the administration interface and nobody can log in, these two flaws stay out of reach. But if remote management is exposed, or the password is still the one printed on the label, that condition is already satisfied.
What the research actually documents
The CVE references point to a public advisory from researchers at Guangzhou University, credited to Boyu Liu, Hui Lu and Zhihong Tian. That advisory is more specific than the CVE summary, and it is also more modest about impact.
It describes unbounded sprintf and strcat operations that copy attacker-controlled DNS values into 72-byte stack buffers with no validation. For impact, it states that oversized data corrupts stack memory and crashes the web management process.
A crash is not code execution. The CVSS metrics assert High impact on confidentiality, integrity and availability, which implies full control of the device. The published research supports the availability half of that claim clearly. For remote code execution, no working exploit has been published, so I cannot confirm this. Stack overflows in embedded web servers often do turn into code execution, yet that general pattern is not evidence about these two functions.
Two settings pages you have probably never opened
Both functions handle settings that most owners configure once, or never. Dynamic DNS maps a changing home IP address to a fixed hostname, which matters if you run a server or reach a camera from outside. The WAN DNS fields decide which resolver the router hands to your devices.
That has a practical bearing on exposure. The handlers live in the firmware whether or not you ever filled in the form, so switching the feature off in the interface is not the same as removing the code. Whether the handler still accepts input while the feature is disabled is not documented anywhere public, and I cannot confirm it either way.
Why no fix is coming
D-Link published a security announcement for the DIR-878 on 17 November 2025 and last updated it on 21 September 2026. The document covers all DIR-878 models, derivative models, hardware revisions and firmware versions, and it states that the product has reached end of life and end of service.
The company's own support page for the model is just as blunt. It lists the DIR-878 as an AC1900 MU-MIMO Wi-Fi router and records that technical support ended on 31 January 2021.
D-Link's recommendation in that announcement is to move to a current-generation product, to back up data comprehensively, and to contact a regional office for further advice. It also warns that continued use may harm other connected devices.
The four flaws D-Link already acknowledged
That announcement is not an empty page. It already lists four earlier CVEs for the same router, all from 2025. CVE-2025-60672 and CVE-2025-60673 cover arbitrary command execution through the Dynamic DNS settings and the DMZ settings. CVE-2025-60674 covers a stack overflow in USB serial number handling. CVE-2025-60676 covers arbitrary command execution through a quality-of-service rule configuration file.
Read that list next to the new pair and a pattern appears. The same administration interface keeps producing the same class of bug, and two of the older entries are described as command execution rather than a crash. D-Link added the two September 2026 records to that announcement on 21 September, under the same end-of-life status, so no fix is planned for them either.
What to do this week
Start by confirming the model and the firmware. The label on the underside gives the model and hardware revision, and the administration interface reports the build. If it reads 120B05, these records apply directly. Older builds are not proven safe either, because nobody has tested them publicly against these two functions.
Next, close the easy paths. Disable remote management from the wide area network, change the administration password to something unique and long, and check that no port forward exposes the router's own web interface. None of that patches the overflow, but it removes the login an attacker needs first.
Then plan the replacement, because a router that stopped receiving firmware in early 2021 will keep collecting flaws like these. A DIR-878 owner does not need to jump to a tri-band flagship to fix that. The TP-Link Archer BE230 keeps the same dual-band layout, adds Multi-Link Operation across 2.4 and 5 GHz, and still receives firmware, which is the part that matters most here.
What is still unknown
Two things remain open. No proof-of-concept for code execution has been published, so the practical ceiling of these flaws is unproven. D-Link has added both CVEs to its end-of-life announcement but says nothing about scope beyond the 120B05 build. And no public report describes exploitation in the wild.
None of that makes the router safe. It does mean the right response is a planned replacement rather than a panic, provided the administration interface is not reachable from the internet.
