Two Critical D-Link DIR-878 CVEs, and No Fix Is Coming

Two new critical vulnerabilities landed in the CVE database over the weekend for the D-Link DIR-878, a consumer AC1900 router that shipped in 2017 and is still sitting on shelves and in closets everywhere. Both carry a CVSS v3 score of 9.9, and the short version is this: D-Link is not going to fix either one, because D-Link stopped supporting this router more than five years ago.

We track this kind of thing daily at RouterCVE.com, where you can see the entries for CVE-2026-90692 and CVE-2026-90693, and this pair is worth walking through in detail. Not because the DIR-878 is a product we sell (it is not), but because it is a clean, current example of a pattern every router owner should understand: the vulnerabilities keep coming long after the patches stop.

What the two CVEs actually are

CVE-2026-90692 lives in the router’s Dynamic DNS IPv6 settings handler, a function called SetDynamicDNSIPv6Settings. When the router receives a request to update that setting, it copies the IPv6Address and Hostname values into a fixed-size buffer on the stack without checking how long they are.

CVE-2026-90693 lives in the WAN settings handler, a function called SetWan3Settings, and is triggered through the Primary and Secondary arguments, the fields that typically hold the primary and secondary DNS server addresses for a WAN connection. Same failure: the values are copied into a fixed-size stack buffer with no length check.

In both cases, feed the function a value longer than the buffer expects and the extra bytes spill over into adjacent memory. That is a stack-based buffer overflow, classified as CWE-119 in the NVD record and CWE-121 by the reporting CNA. It is one of the oldest bug classes in software, and it remains one of the most dangerous on embedded devices, because a successful overflow can overwrite the function’s return address and redirect the processor to code the attacker supplied. In practical terms, that means arbitrary code execution on the router with the same privileges as the web server process, which on most consumer firmware is root.

Both CVEs list the affected firmware as version 1.20B05. That matters, because 1.20B05 is the final firmware D-Link ever released for the DIR-878. There is nothing newer to upgrade to.

The two entries were assigned consecutive CVE numbers and published on the same day, which almost always means one researcher working through one firmware image found both. That is a pattern worth remembering, and we will come back to it.

Reading the CVSS vector

Both CVEs share the same published vector, which is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Here is what each part tells you:

• AV:N (Network). The attack is delivered over the network. No physical access, no USB stick, no local shell needed.
• AC:L (Low complexity). No special conditions or race timing. If the endpoint is reachable, the attack is repeatable.
• PR:L (Low privileges). This is the one honest wrinkle. The vector says a low-privilege account is required to reach the vulnerable function. On a consumer router, that typically means the attacker needs to be logged into the admin interface, or needs to pair this with a separate authentication bypass.
• UI:N (No user interaction). Nobody has to click anything.
• S:C (Scope changed). Compromising the router lets the attacker affect things beyond the router itself, meaning every device behind it.
• C:H / I:H / A:H. Full loss of confidentiality, integrity, and availability.

A 9.9 with PR:L instead of PR:N means the scoring committee is treating the credential requirement as a speed bump, not a wall. Given that default and reused credentials remain the single most common way consumer routers get compromised, that assessment is fair.

The part that matters: D-Link’s answer is “replace it”

This is where the story stops being about one bug and starts being about product lifecycles.

D-Link’s official position on the DIR-878 is spelled out in security advisory SAP10475, first published in November 2025 and last updated on June 30, 2026. The advisory states that all DIR-878 models, derivative models, hardware revisions, and firmware versions reached end-of-life and end-of-service on January 31, 2021. D-Link recommends three actions: transition to a current-generation product, back up your data, and contact a regional office if you need more guidance.

The advisory does not list a firmware fix, because there is not one. D-Link’s stated policy is that products past EOL/EOS may no longer receive technical support or firmware updates, and the company cautions that continued use may harm other devices connected to the router.

So when the RouterCVE entries for both CVEs show “Unpatched” in the Patch Status column, that is not a lag in data collection. It is the permanent state of these vulnerabilities.

These are the fifth and sixth critical DIR-878 flaws in ten months

This weekend’s pair did not arrive in a vacuum. Last November, D-Link’s SAP10475 advisory disclosed a cluster of vulnerabilities in the same router:

• CVE-2025-60672 is an unauthenticated remote command execution flaw in SetDynamicDNSSettings, where the ServerAddress and Hostname parameters get stored in NVRAM and later used to build system commands.
• CVE-2025-60673 is another unauthenticated RCE, this time through the SetDMZSettings IPAddress parameter being injected into iptables commands.
• CVE-2025-60674 is a stack overflow in the USB storage handler, requiring physical access.
• CVE-2025-60676 is a command injection through the QoS rule file.

Notice the pattern. CVE-2025-60672 lives in SetDynamicDNSSettings, the IPv4 version of Dynamic DNS configuration. CVE-2026-90692 lives in SetDynamicDNSIPv6Settings, its IPv6 sibling. CVE-2026-90693 lives in SetWan3Settings, a different feature in the same family of configuration handlers. Same firmware, same class of input handling failure, three different entry points. When a codebase has one unchecked input path, it very often has several, and researchers who find the first one know exactly where to look for the next. Consecutive CVE numbers published on the same day are the fingerprint of exactly that process.

Public proof-of-concept exploit code for the 2025 flaws was already circulating by the time D-Link published its advisory, and those flaws were quickly associated with botnet activity targeting end-of-life routers. There is no reason to expect the two new vulnerabilities to be treated any differently.

What “end of life” really means for a router

Router vendors use two related terms that are worth separating:

End of Life (EOL) means the product is no longer manufactured or sold by the vendor. Retailers and resellers can keep selling existing stock, sometimes for years.

End of Service (EOS) or End of Support means the vendor has stopped developing firmware for the product. No bug fixes, no security patches, no technical support.

For the DIR-878, both dates were January 31, 2021. That means every vulnerability discovered since then, including all six listed above, was found in a device the vendor had already stopped maintaining. The hardware kept working. The security kept degrading.

This is the uncomfortable truth about network equipment: unlike a laptop or a phone, a router usually gives you no visible signal that it has aged out. It routes packets on day one and it routes packets on day 3,000. The only thing that changes is how many people know how to break into it.

What to do if you own a DIR-878

We are going to be direct: retire it. D-Link says the same thing.

If you cannot replace it immediately, the following steps reduce your exposure but do not eliminate it:

1. Confirm remote management is off. The web admin interface should never be reachable from the WAN side. On the DIR-878, check under Management for any remote access or cloud access toggles and disable them.
2. Disable Dynamic DNS entirely. Both the IPv4 and IPv6 DDNS handlers have critical flaws. If you are not actively using DDNS, turn it off. This removes one vulnerable code path from normal operation, though it does not remove the code from the firmware, and it does nothing for CVE-2026-90693, which lives in WAN settings you cannot turn off.
3. Change the admin password to something long and unique. Since both new CVEs require low privileges, strong credentials are the main barrier between an attacker and the vulnerable function.
4. Make sure you are on 1.20B05. It is the last firmware, it is vulnerable, and it is still better than anything older.
5. Segment anything sensitive. If a compromised DIR-878 is sitting in front of a NAS, cameras, or a work laptop, it is a stepping stone to all of them.

None of this substitutes for a supported device. It buys time.

Do not buy one used, either

This part deserves its own heading, because it is where people get burned.

The DIR-878 is still easy to find. It shows up on Amazon third-party listings, eBay, Facebook Marketplace, and refurbished-electronics sites, often for $40 to $80, and sometimes described as “new in box.” Nothing on the box or in the listing says the router lost vendor support in January 2021. To a buyer comparing specs and prices, an AC1900 router at that price looks like a deal.

It is not a deal. You would be paying for a device that D-Link itself says should be retired, with six critical vulnerabilities on record, at least two of them with public exploit code, and a vendor commitment to fix exactly none of them. Every dollar spent on a used DIR-878 is a dollar spent on a known-compromisable device with zero remaining support life.

The same logic applies to any router past end-of-service, not just this one. Before buying network hardware on the secondary market, look up the model on the vendor’s support site and on RouterCVE.com. If the vendor lists it as EOL or EOS, walk away no matter how good the price looks. A router that cannot be patched is not a bargain at any price.

If you have a DIR-878 you are retiring, the responsible move is to factory reset it and recycle it through an e-waste program, not to resell it to someone who does not know what they are getting.

The honest counterpoint

It would be easy to write this post as a hit piece on D-Link, and that would be unfair.

D-Link supported the DIR-878 from its 2017 launch through January 2021, which is a reasonable lifespan for a consumer router in that price class. The company publishes security advisories for EOL products even though it has no obligation to patch them, and SAP10475 is clear, specific, and links to the relevant CVE records. Plenty of vendors quietly let EOL products fade with no advisory at all. D-Link’s transparency here is better than the industry norm.

The DIR-878 also sold for a fraction of what the business-class equipment we carry costs. Expecting a $100 router bought in 2018 to receive security updates in 2026 is expecting something no vendor in that market segment has ever delivered.

The real critique is not that D-Link stopped supporting the router. It is that the router kept getting sold, new, by third parties long after support ended, with nothing on the box to tell a buyer that the clock had already run out. That is an industry-wide problem, and it is one of the reasons the FCC and other regulators have started paying attention to device support lifecycles.

Why this matters even if you would never buy a DIR-878

At 5Gstore we specialize in business-grade cellular and networking equipment from Peplink, Cradlepoint, Teltonika, Semtech, Inseego, Digi, and Katalyst. None of those brands are the subject of this post. But every one of them has a product lifecycle, and every one of them will eventually EOL hardware you may still be running.

The lesson from this pair of CVEs is not “avoid D-Link.” It is:

• Know the EOL and EOS dates for every router in your fleet. If you do not know, find out this week.
• Treat a router past EOS as a liability with a countdown, not as an asset that still works.
• Budget for replacement before the vendor stops patching, not after the first critical CVE lands.
• Use a tracking tool. We built RouterCVE.com so you can look up any router and see its open vulnerabilities and patch status in one place. Bookmark the models you run.

Vendors like Peplink publish explicit product lifecycle pages and long-term support firmware branches for exactly this reason. Cradlepoint ties support to NetCloud subscriptions. Teltonika and Digi both maintain published EOL schedules. That is what you are paying for with business-class gear, and it is worth understanding before you need it.

Frequently asked questions

Is there a firmware update for CVE-2026-90692 or CVE-2026-90693?
No. The DIR-878 reached end-of-service on January 31, 2021. D-Link’s advisory SAP10475 confirms no further updates will be released and recommends replacing the device.

Can this be exploited from the internet?
The attack vector is network-based. If remote management is exposed to the WAN, yes. If the admin interface is only reachable from your LAN, an attacker would need to be on your network or pair this with another flaw. Combined with the unauthenticated 2025 RCE vulnerabilities in the same firmware, you should assume the answer is yes in practice.

Does disabling Dynamic DNS make me safe?
It removes the CVE-2026-90692 function from normal use and is a sensible step. It does not fix the underlying code, and it does nothing about CVE-2026-90693 in WAN settings or the 2025 RCE flaws, which hit different functions. Replacement is the only complete fix.

Is 1.20B05 the latest firmware?
Yes. It is the final firmware D-Link released for the DIR-878 and it is the version listed as affected in both CVEs.

Is it safe to buy a DIR-878 used or refurbished?
No. The router has been out of support since January 2021, has six critical CVEs with no fix, and D-Link recommends retiring it. Sellers rarely disclose EOL status. Check any used router’s support status before buying, and skip anything the vendor lists as EOL or EOS.

Which 5Gstore routers are affected by these CVEs?
None. Both vulnerabilities are specific to the D-Link DIR-878. We do not carry D-Link consumer routers.

Where can I check whether my router has open vulnerabilities?
Search your model at RouterCVE.com, which aggregates NVD data with patch status for hundreds of router models.

5Gstore Take

We have been selling and supporting routers since 2005, and the single most expensive mistake we see is treating network hardware as “done” once it is installed. A router is a computer facing the internet 24 hours a day, and its security has a shelf life whether or not anyone is watching the calendar.

If you are running equipment that is past its support window, or you are not sure whether it is, contact our team. We can help you identify what you have, check its lifecycle status, and map out a replacement plan built around supported hardware from Peplink, Cradlepoint, Teltonika, Semtech, Inseego, Digi, and Katalyst.