CVE-2022-26670: high-severity vulnerability in D-Link DIR-878
D-Link DIR-878 - Command Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 1.5%
D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack to execute arbitrary system commands to control the system or disrupt service.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
D-Link · DIR-878Related CVEs — D-Link DIR-878
In the same product, most dangerous first.
CVE-2024-0717MEDIUMD-Link Good Line Router v2 HTTP GET Request devinfo information disclosureEPSS 18.2%CVE-2025-0481MEDIUMD-Link DIR-878 HTTP POST Request dllog.cgi information disclosureEPSS 1.4%CVE-2026-90693CRITICALD-Link DIR-878 WAN Settings SetWan3Settings stack-based overflowEPSS 0.9%CVE-2026-90692CRITICALD-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflowEPSS 0.9%