CVE-2026-124560 · Infrastructure
NO FIX YET
A heap-based buffer overflow in the GetCAPTCHAsetting function of the HNAP handler in bin/prog.cgi on D-Link DIR-878 1.20B05 is triggered by an oversized uid argument. A remote attacker can send a crafted request to the router, and a public exploit exists.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Owners of D-Link DIR-878 routers running firmware 1.20B05, especially those with remote administration or HNAP reachable from the internet. The sources state that the product is no longer supported by the maintainer, so no fix may come. Networks where the router is not exposed to the internet face less risk.
Not affected if not-internet-exposed, other-firmware-version, replaced-device
Who cares d-link, dir-878, end-of-life, hnap, home-router
No fix yet, per the sources.
A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.