Vulnerability · Published Sep 15, 2026 · Assigned by VulDB

CVE-2026-90880D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection

High 7.4

In plain English

A high-severity command injection in DSL-3782 from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)1.9%top 19.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
D-Link	DSL-3782	2016-07-28

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-403474 | D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection vdb-entry, technical-description
VDB-403474 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-90880 | CVE Analysis and Report third-party-advisory
Submit #928835 | D-Link DSL-3782 D-Link DSL-3782, firmware build 2016-07-28 (BUILDDATE=20160728155732) Firmware image SHA-256: c8faaffbac46194a716e311e84f79ae551 Command Injection third-party-advisory
https://github.com/MeetFireAgain/cve/tree/main/dlink-dsl3782 exploit
https://www.dlink.com/ product