Executive brief
The D-Link DIR-878 router's web management interface contains a buffer overflow vulnerability in its Dynamic DNS IPv6 configuration feature. An attacker can send a specially crafted request with an oversized IPv6 address or hostname to crash the router's web service or potentially execute arbitrary code, disrupting network connectivity and device management.
Technical details
A stack-based buffer overflow exists in the SetDynamicDNSIPv6Settings handler (CWE-121) due to unbounded sprintf operations that copy attacker-controlled IPv6Address and Hostname values into fixed-size stack buffers without length validation. The vulnerability is reachable remotely via the web management interface at the /SetDynamicDNSIPv6Settings endpoint. An attacker can exploit this by sending an oversized IPv6 address or hostname parameter to cause stack memory corruption, crash the web management process, or potentially achieve remote code execution. The vulnerability affects firmware version 120B05; patches from D-Link have not yet been widely announced.
Affected products
- D-Link DIR-878 120B05
Timeline
- 2026-09-14: disclosed: Vulnerability published on NVD
- 2026-08-04: other: Vendor D-Link notified of vulnerability