High severity · published Sep 15, 2026
CVE-2026-90880
D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection
7.4
CVSS
1.9%
EPSS
No
On KEV
Description
A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
DSL-3782 · D-Link
2016-07-28 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90880
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90880
github.com
https://github.com/MeetFireAgain/cve/tree/main/dlink-dsl3782
vuldb.com
https://vuldb.com/cve/CVE-2026-90880
vuldb.com
https://vuldb.com/submit/928835
vuldb.com
https://vuldb.com/vuln/403474
vuldb.com
https://vuldb.com/vuln/403474/cti
www.dlink.com
https://www.dlink.com/