Common Weakness Enumeration
CWE-121
AllowedStack-based Buffer Overflow
Abstraction: Variant · Status: Draft
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
5784 vulnerabilities reference this CWE, most recent first.
CVE-2026-91003 (GCVE-0-2026-91003)
Vulnerability from cvelistv5 – Published: 2026-09-15 05:45 – Updated: 2026-09-15 14:05
VLAI
EPSS
VEX
Title
D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow
Summary
A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Severity
9.1 (Critical)
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:05 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403586 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403586/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-91003 | third-party-advisory |
| https://vuldb.com/submit/932002 | third-party-advisory |
| https://github.com/Vivi-Xray/Xray-s-cve-/blob/mai… | related |
| https://github.com/Vivi-Xray/Xray-s-cve-/blob/mai… | exploit |
| https://www.dlink.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91003",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:05:18.585462Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:05:24.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Vivi-Xray/Xray-s-cve-/blob/main/rzgl/rzgl_asp.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:d-link:di-8300:*:*:*:*:*:*:*:*"
],
"modules": [
"CGI Service"
],
"product": "DI-8300",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "16.07"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Xray (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T05:45:16.561Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403586 | D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403586"
},
{
"name": "VDB-403586 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403586/cti"
},
{
"name": "CVE-2026-91003 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-91003"
},
{
"name": "Submit #932002 | D-Link DI-8300 16.07 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/932002"
},
{
"tags": [
"related"
],
"url": "https://github.com/Vivi-Xray/Xray-s-cve-/blob/main/rzgl/rzgl_asp.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Vivi-Xray/Xray-s-cve-/blob/main/rzgl/rzgl_asp.py"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-14T17:52:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-91003",
"datePublished": "2026-09-15T05:45:16.561Z",
"dateReserved": "2026-09-14T15:47:25.367Z",
"dateUpdated": "2026-09-15T14:05:24.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91001 (GCVE-0-2026-91001)
Vulnerability from cvelistv5 – Published: 2026-09-15 05:15 – Updated: 2026-09-15 13:59
VLAI
EPSS
VEX
Title
D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow
Summary
A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 13:59 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403582 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403582/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-91001 | third-party-advisory |
| https://vuldb.com/submit/931642 | third-party-advisory |
| https://github.com/Vivi-Xray/Xray-s-cve-/tree/mai… | related |
| https://github.com/Vivi-Xray/Xray-s-cve-/blob/mai… | exploit |
| https://www.dlink.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91001",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T13:59:05.976699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T13:59:20.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:d-link:di-8400:*:*:*:*:*:*:*:*"
],
"modules": [
"DDNS Configuration"
],
"product": "DI-8400",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "16.07"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Xray (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T05:15:14.158Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403582 | D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403582"
},
{
"name": "VDB-403582 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403582/cti"
},
{
"name": "CVE-2026-91001 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-91001"
},
{
"name": "Submit #931642 | D-Link DI-8400 16.07 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/931642"
},
{
"tags": [
"related"
],
"url": "https://github.com/Vivi-Xray/Xray-s-cve-/tree/main/ddns_asp"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Vivi-Xray/Xray-s-cve-/blob/main/ddns_asp/ddns_asp.py"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-14T17:40:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-91001",
"datePublished": "2026-09-15T05:15:14.158Z",
"dateReserved": "2026-09-14T15:34:55.062Z",
"dateUpdated": "2026-09-15T13:59:20.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90824 (GCVE-0-2026-90824)
Vulnerability from cvelistv5 – Published: 2026-09-14 21:00 – Updated: 2026-09-15 14:44 X_Open Source
VLAI
EPSS
VEX
Title
GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow
Summary
A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:44 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403326 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403326/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90824 | third-party-advisory |
| https://vuldb.com/submit/914949 | third-party-advisory |
| https://github.com/gpac/gpac/issues/3804 | issue-tracking |
| https://github.com/user-attachments/files/3039888… | exploit |
| https://github.com/gpac/gpac/commit/9eb40df4448b8… | patch |
| https://github.com/gpac/gpac/releases/tag/abi-16.23 | patch |
| https://github.com/gpac/gpac/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90824",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:44:42.543009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:44:51.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/914949"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/gpac/gpac/issues/3804"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"
],
"modules": [
"MP4Box"
],
"product": "GPAC",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "26.07.0"
},
{
"status": "unaffected",
"version": "abi-16.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fczhang (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T21:00:13.906Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403326 | GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403326"
},
{
"name": "VDB-403326 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403326/cti"
},
{
"name": "CVE-2026-90824 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90824"
},
{
"name": "Submit #914949 | GPAC GPAC MP4Box v26.07.0 Stack Overflow due to Uncontrolled Recursion",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/914949"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/gpac/gpac/issues/3804"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/30398880/poc_08_add.zip"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gpac/gpac/releases/tag/abi-16.23"
},
{
"tags": [
"product"
],
"url": "https://github.com/gpac/gpac/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T21:21:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90824",
"datePublished": "2026-09-14T21:00:13.906Z",
"dateReserved": "2026-09-13T19:16:38.471Z",
"dateUpdated": "2026-09-15T14:44:51.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90823 (GCVE-0-2026-90823)
Vulnerability from cvelistv5 – Published: 2026-09-17 11:57 – Updated: 2026-09-17 14:10
VLAI
EPSS
VEX
Summary
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root.
The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources.
Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:08 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| FatPipe Networks | MPVPN |
Affected:
10.1.2r60p100
|
|
| FatPipe Networks | WARP |
Affected:
10.1.2r60p100
|
|
| FatPipe Networks | IPVPN |
Affected:
10.1.2r60p100
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90823",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:08:40.762478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:10:27.493Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "MPVPN",
"vendor": "FatPipe Networks",
"versions": [
{
"status": "affected",
"version": "10.1.2r60p100"
}
]
},
{
"defaultStatus": "unknown",
"product": "WARP",
"vendor": "FatPipe Networks",
"versions": [
{
"status": "affected",
"version": "10.1.2r60p100"
}
]
},
{
"defaultStatus": "unknown",
"product": "IPVPN",
"vendor": "FatPipe Networks",
"versions": [
{
"status": "affected",
"version": "10.1.2r60p100"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Wincey (@rwincey, Securifera)"
}
],
"descriptions": [
{
"lang": "en",
"value": "FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root.\n\nThe affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources.\n\nCustomers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T12:10:49.961Z",
"orgId": "c35fbbdf-8d87-49b6-8120-920a36e62b7f",
"shortName": "Securifera"
},
"references": [
{
"url": "https://www.securifera.com/advisories/"
},
{
"url": "https://www.fatpipeinc.com/support/support"
}
],
"solutions": [
{
"lang": "en",
"value": "Customers running the affected end-of-life firmware should contact FatPipe Support to upgrade their appliances to the latest supported software release. The vulnerability has been addressed in current FatPipe software, and a remediated release is already available. As an interim mitigation pending the upgrade, leave the affected management interface disabled if it is not required, restrict management access to trusted administrative networks, use WAN access control lists to permit connections only from authorized source addresses, and avoid exposing the management interface directly to the public Internet."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c35fbbdf-8d87-49b6-8120-920a36e62b7f",
"assignerShortName": "Securifera",
"cveId": "CVE-2026-90823",
"datePublished": "2026-09-17T11:57:54.936Z",
"dateReserved": "2026-09-13T19:10:47.080Z",
"dateUpdated": "2026-09-17T14:10:27.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90779 (GCVE-0-2026-90779)
Vulnerability from cvelistv5 – Published: 2026-09-13 11:42 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter
Summary
SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 15:33 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/SIPp/sipp/pull/880 | patchissue-tracking |
| https://github.com/SIPp/sipp/commit/1d4a5622bea34… | patch |
| https://github.com/SIPp/sipp/blob/v3.7.7/src/auth… | technical-description |
| https://github.com/SIPp/sipp | product |
| https://www.vulncheck.com/advisories/sipp-through… | third-party-advisory |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90779",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T15:33:55.105739Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T15:34:22.150Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "sipp",
"repo": "https://github.com/SIPp/sipp",
"vendor": "SIPp",
"versions": [
{
"lessThanOrEqual": "3.7.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:59.067Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #880",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/SIPp/sipp/pull/880"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/SIPp/sipp/commit/1d4a5622bea34d0b5cdff333e6b5734608e30af7"
},
{
"name": "Unbounded strncpy into algo[32] in createAuthHeader() at v3.7.7",
"tags": [
"technical-description"
],
"url": "https://github.com/SIPp/sipp/blob/v3.7.7/src/auth.cpp#L183-L192"
},
{
"tags": [
"product"
],
"url": "https://github.com/SIPp/sipp"
},
{
"name": "VulnCheck Advisory: SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sipp-through-3.7.7-stack-buffer-overflow-via-createauthheader-algorithm-parameter"
}
],
"title": "SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90779",
"datePublished": "2026-09-13T11:42:28.431Z",
"dateReserved": "2026-09-13T11:15:54.633Z",
"dateUpdated": "2026-09-24T14:21:59.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90693 (GCVE-0-2026-90693)
Vulnerability from cvelistv5 – Published: 2026-09-14 07:15 – Updated: 2026-09-15 15:59
VLAI
EPSS
VEX
Title
D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow
Summary
A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 15:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403226 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403226/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90693 | third-party-advisory |
| https://vuldb.com/submit/915573 | third-party-advisory |
| https://github.com/Amalll-Sec/router-vulnerabilit… | related |
| https://www.dlink.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90693",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T15:59:29.350310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:59:35.688Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/d-link/dir-878/SetWan3Settings/README.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:d-link:dir-878:*:*:*:*:*:*:*:*"
],
"modules": [
"WAN Settings"
],
"product": "DIR-878",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "120B05"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "AmaIIl (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T07:15:10.675Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403226 | D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403226"
},
{
"name": "VDB-403226 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403226/cti"
},
{
"name": "CVE-2026-90693 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90693"
},
{
"name": "Submit #915573 | D-Link Router FW120B05_decode Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/915573"
},
{
"tags": [
"related"
],
"url": "https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/d-link/dir-878/SetWan3Settings/README.md"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T07:14:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90693",
"datePublished": "2026-09-14T07:15:10.675Z",
"dateReserved": "2026-09-13T05:09:18.973Z",
"dateUpdated": "2026-09-15T15:59:35.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90692 (GCVE-0-2026-90692)
Vulnerability from cvelistv5 – Published: 2026-09-14 07:00 – Updated: 2026-09-15 13:57
VLAI
EPSS
VEX
Title
D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow
Summary
A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of the argument IPv6Address/Hostname results in stack-based buffer overflow. The attack may be launched remotely.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 13:50 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403225 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403225/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90692 | third-party-advisory |
| https://vuldb.com/submit/915572 | third-party-advisory |
| https://github.com/Amalll-Sec/router-vulnerabilit… | related |
| https://www.dlink.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T13:50:25.797298Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T13:57:52.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:d-link:dir-878:*:*:*:*:*:*:*:*"
],
"modules": [
"Dynamic DNS IPv6 Settings"
],
"product": "DIR-878",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "120B05"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "AmaIIl (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of the argument IPv6Address/Hostname results in stack-based buffer overflow. The attack may be launched remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T07:00:08.862Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403225 | D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403225"
},
{
"name": "VDB-403225 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403225/cti"
},
{
"name": "CVE-2026-90692 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90692"
},
{
"name": "Submit #915572 | D-Link Router FW120B05_decode Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/915572"
},
{
"tags": [
"related"
],
"url": "https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/d-link/dir-878/SetDynamicDNSIPv6Settings/README.md"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T07:14:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90692",
"datePublished": "2026-09-14T07:00:08.862Z",
"dateReserved": "2026-09-13T05:09:14.905Z",
"dateUpdated": "2026-09-15T13:57:52.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90689 (GCVE-0-2026-90689)
Vulnerability from cvelistv5 – Published: 2026-09-14 06:15 – Updated: 2026-09-14 10:55
VLAI
EPSS
VEX
Title
Tenda W20E formDelWebAuthWhiteUser stack-based overflow
Summary
A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 10:54 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403222 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403222/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90689 | third-party-advisory |
| https://vuldb.com/submit/914981 | third-party-advisory |
| https://github.com/Amalll-Sec/router-vulnerabilit… | related |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T10:54:39.870335Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:55:57.386Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:w20e_firmware:*:*:*:*:*:*:*:*"
],
"product": "W20E",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.11.0.61068_1546_841_CN_TDC"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "AmaIIl (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T06:15:08.707Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403222 | Tenda W20E formDelWebAuthWhiteUser stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403222"
},
{
"name": "VDB-403222 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403222/cti"
},
{
"name": "CVE-2026-90689 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90689"
},
{
"name": "Submit #914981 | Tenda Router US_W20EV4.0br_V15.11.0.61068_1546_841_CN_TDC Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/914981"
},
{
"tags": [
"related"
],
"url": "https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/Tenda/W20E/formDelWebAuthWhiteUser/README.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T07:06:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda W20E formDelWebAuthWhiteUser stack-based overflow",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90689",
"datePublished": "2026-09-14T06:15:08.707Z",
"dateReserved": "2026-09-13T05:01:50.679Z",
"dateUpdated": "2026-09-14T10:55:57.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90688 (GCVE-0-2026-90688)
Vulnerability from cvelistv5 – Published: 2026-09-14 06:00 – Updated: 2026-09-15 15:57
VLAI
EPSS
VEX
Title
Tenda W20E HTTP formIPMacBindAdd stack-based overflow
Summary
A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 15:57 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403221 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403221/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90688 | third-party-advisory |
| https://vuldb.com/submit/914958 | third-party-advisory |
| https://github.com/Amalll-Sec/router-vulnerabilit… | related |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90688",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T15:57:29.684776Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:57:34.857Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/Tenda/W20E/formIPMacBindAdd/README.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:w20e_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"HTTP Handler"
],
"product": "W20E",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.11.0.61068_1546_841_CN_TDC"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "AmaIIl (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T06:00:12.401Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403221 | Tenda W20E HTTP formIPMacBindAdd stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403221"
},
{
"name": "VDB-403221 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403221/cti"
},
{
"name": "CVE-2026-90688 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90688"
},
{
"name": "Submit #914958 | Tenda Router US_W20EV4.0br_V15.11.0.61068_1546_841_CN_TDC Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/914958"
},
{
"tags": [
"related"
],
"url": "https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/Tenda/W20E/formIPMacBindAdd/README.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T07:06:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda W20E HTTP formIPMacBindAdd stack-based overflow",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90688",
"datePublished": "2026-09-14T06:00:12.401Z",
"dateReserved": "2026-09-13T05:01:47.157Z",
"dateUpdated": "2026-09-15T15:57:34.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90680 (GCVE-0-2026-90680)
Vulnerability from cvelistv5 – Published: 2026-09-14 04:00 – Updated: 2026-09-16 14:43
VLAI
EPSS
VEX
Title
D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow
Summary
A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway results in stack-based buffer overflow. The attack can be launched remotely.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:43 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403213 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403213/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90680 | third-party-advisory |
| https://vuldb.com/submit/914902 | third-party-advisory |
| https://github.com/Amalll-Sec/router-vulnerabilit… | related |
| https://www.dlink.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90680",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:43:23.776615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:43:39.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:d-link:dir-823g:*:*:*:*:*:*:*:*"
],
"modules": [
"HNAP1"
],
"product": "DIR-823G",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "1.0.2B05_20181207"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "AmaIIl (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway results in stack-based buffer overflow. The attack can be launched remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T04:00:08.963Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403213 | D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403213"
},
{
"name": "VDB-403213 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403213/cti"
},
{
"name": "CVE-2026-90680 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90680"
},
{
"name": "Submit #914902 | D-Link Router DIR823G_V1.0.2B05_20181207 Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/914902"
},
{
"tags": [
"related"
],
"url": "https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/d-link/dir-823g/SetStaticRouteSettings/README.md"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T06:53:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90680",
"datePublished": "2026-09-14T04:00:08.963Z",
"dateReserved": "2026-09-13T04:47:27.543Z",
"dateUpdated": "2026-09-16T14:43:39.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
No CAPEC attack patterns related to this CWE.