CVE-2026-90880
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Risk Assessment
The vulnerability allows a remote attacker to execute arbitrary system commands on the device, potentially leading to full control over the router. The risk is high because the exploit is publicly available.
Recommendation
Update the D-Link DSL-3782 firmware to the latest version if available. If not, consider disabling remote access to the administrative interface and restricting network access.
Other vulnerabilities in D-Link DSL-3782
See all- CVE-2023-27216High
An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page.
- CVE-2022-35192High
An unauthenticated attacker can cause a Denial of Service (DoS) on the D-Link DSL-3782 router by sending crafted User or Pwd parameters to Login.asp. The vulnerability affects firmware version v1.01.
- CVE-2022-35191Medium
An unauthenticated attacker can cause a Denial of Service (DoS) on the D-Link DSL-3782 router by sending a crafted HTTP request. The vulnerability exists in firmware version v1.01.
Original NVD description (English source)
A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS