A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

A command injection vulnerability has been discovered in the D-Link DSL-3782 router, specifically in the Diagnostics component located at /cgi-bin/New_GUI/Set/Diagnostics.asp. The flaw allows manipulation of the 'Addr' argument to inject arbitrary commands via the system function. The vulnerability can be exploited remotely without physical access to the device. A public exploit has already been released, increasing the risk of active exploitation in the wild. The affected firmware version is dated 2016-07-28, indicating a legacy device that may not receive patches. This poses a significant risk to users of this D-Link router model, particularly those with remote management interfaces exposed to the internet. The vulnerability is tracked as CVE-2026-90880 and is listed in NVD and VulDB databases.