{"id":"CVE-2026-124560","kind":"vulnerability","aliases":["CVE-2026-124560"],"related":[],"title":"D-Link DIR-878 router: heap overflow in HNAP handler lets remote attackers in","description":"A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"A heap-based buffer overflow in the GetCAPTCHAsetting function of the HNAP handler in bin/prog.cgi on D-Link DIR-878 1.20B05 is triggered by an oversized uid argument. A remote attacker can send a crafted request to the router, and a public exploit exists.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["d-link","dir-878","end-of-life","hnap","home-router","infrastructure"],"not_affected_if":["not-internet-exposed","other-firmware-version","replaced-device"],"how_to_check":"Affected per NVD: DIR-878 firmware 1.20B05. Check the firmware version on the router admin page. Also check whether remote administration (HNAP/web management) is reachable from the WAN side; whether it is on by default is unconfirmed. Until D-Link guidance is found, turn off remote management and consider replacing the router if it is end-of-life.","fix":null,"status":"open","published_at":"2026-11-09T03:16:38+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","triaged_at":"2026-11-09T03:26:24+00:00","updated_at":"2026-11-09T03:27:20+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-09T03:26:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link DIR-878 router: heap overflow in HNAP handler lets remote attackers in","impact":"high","summary":"A heap-based buffer overflow in the GetCAPTCHAsetting function of the HNAP handler in bin/prog.cgi on D-Link DIR-878 1.20B05 is triggered by an oversized uid argument. A remote attacker can send a crafted request to the router, and a public exploit exists.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["d-link","dir-878","home-router","hnap","end-of-life"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the router remotely via heap overflow.","analyst_note":"Confirm whether D-Link has any fix or replacement guidance for the DIR-878 and whether HNAP is exposed by default on WAN; the NVD entry gives no fix.","how_to_check":"- Check the firmware version on the router's admin page or with the vendor tooling; the affected version is `1.20B05`.\n- Check whether the HNAP service is reachable from the internet on the router's WAN interface.","plain_action":"If you own a D-Link DIR-878 router, check whether it is running firmware 1.20B05 and whether the vendor has released a newer version; the vendor's support status for this model is discontinued, so a replacement may be the only option.","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-version","not-internet-exposed","replaced-device"],"who_is_affected":"Owners of D-Link DIR-878 routers running firmware 1.20B05, especially those with remote administration or HNAP reachable from the internet. The sources state that the product is no longer supported by the maintainer, so no fix may come. Networks where the router is not exposed to the internet face less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000808,"input_tokens":4581,"output_tokens":700,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether D-Link has any fix or replacement guidance for the DIR-878 and whether HNAP is exposed by default on WAN; the NVD entry gives no fix.","search":"'-124560':17A,20A '-2026':16A,19A '-878':5A,25B,56B,91C '1.20':57B,92C 'affect':95C,141C 'argument':65B,113C 'attack':14A,68B,123C 'b05':58B,93C 'base':38B,119C 'bin/prog.cgi':50B,102C 'buffer':39B,120C 'compon':105C 'could':135C 'craft':72B 'cve':15A,18A 'd':2A,22B,53B,88C 'd-link':1A,21B,52B,87C 'dir':4A,24B,55B,90C 'end':27B 'end-of-lif':26B 'exist':81B 'exploit':80B,129C 'file':101C 'found':85C 'function':44B,97C 'getcaptchaset':43B,98C 'handler':11A,48B,107C 'heap':7A,37B,118C 'heap-bas':36B,117C 'hnap':10A,30B,47B,106C 'home':32B 'home-rout':31B 'infrastructur':34B 'initi':126C 'let':12A 'life':29B 'link':3A,23B,54B,89C 'longer':146C 'made':132C 'maintain':150C 'manipul':110C 'overflow':8A,40B,121C 'overs':63B 'perform':108C 'product':142C 'public':79B,133C 'remot':13A,67B,127C 'request':73B 'result':115C 'router':6A,33B,76B 'send':70B 'support':147C 'trigger':60B 'uid':64B,114C 'use':137C 'vulner':83C,139C","nicknames":[],"mitigations":[],"who_affected":"Owners of D-Link DIR-878 routers running firmware 1.20B05, especially those with remote administration or HNAP reachable from the internet. The sources state that the product is no longer supported by the maintainer, so no fix may come. Networks where the router is not exposed to the internet face less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a D-Link DIR-878 router, check whether it is running firmware 1.20B05 and whether the vendor has released a newer version; the vendor's support status for this model is discontinued, so a replacement may be the only option.","pkeys":[],"ptokens":[],"labels":["critical","dir878","dlink","endoflife","hnap","homerouter","infrastructure"],"campaign_type":null,"search_a":"'-124560':17A,20A '-2026':16A,19A '-878':5A 'attack':14A 'cve':15A,18A 'd':2A 'd-link':1A 'dir':4A 'handler':11A 'heap':7A 'hnap':10A 'let':12A 'link':3A 'overflow':8A 'remot':13A 'router':6A","search_b":"'-878':25B,56B '1.20':57B 'argument':65B 'attack':68B 'b05':58B 'base':38B 'bin/prog.cgi':50B 'buffer':39B 'craft':72B 'd':22B,53B 'd-link':21B,52B 'dir':24B,55B 'end':27B 'end-of-lif':26B 'exist':81B 'exploit':80B 'function':44B 'getcaptchaset':43B 'handler':48B 'heap':37B 'heap-bas':36B 'hnap':30B,47B 'home':32B 'home-rout':31B 'infrastructur':34B 'life':29B 'link':23B,54B 'overflow':40B 'overs':63B 'public':79B 'remot':67B 'request':73B 'router':33B,76B 'send':70B 'trigger':60B 'uid':64B","search_c":"'-878':91C '1.20':92C 'affect':95C,141C 'argument':113C 'attack':123C 'b05':93C 'base':119C 'bin/prog.cgi':102C 'buffer':120C 'compon':105C 'could':135C 'd':88C 'd-link':87C 'dir':90C 'exploit':129C 'file':101C 'found':85C 'function':97C 'getcaptchaset':98C 'handler':107C 'heap':118C 'heap-bas':117C 'hnap':106C 'initi':126C 'link':89C 'longer':146C 'made':132C 'maintain':150C 'manipul':110C 'overflow':121C 'perform':108C 'product':142C 'public':133C 'remot':127C 'result':115C 'support':147C 'uid':114C 'use':137C 'vulner':83C,139C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T03:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124560","severity":null,"published_at":"2026-11-09T03:16:38+00:00","modified_at":"2026-11-09T03:16:38+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","fetched_at":"2026-11-09T03:24:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124560:2236","url":null,"severity":null,"published_at":"2026-11-09T03:27:20+00:00","modified_at":"2026-11-09T03:27:20+00:00","first_seen_at":"2026-11-09T03:27:20+00:00","fetched_at":"2026-11-09T03:27:20+00:00","note":"Could not reach a primary source: web-cli search returned 402 (Exa credits depleted), NVD page fetch returned only the home page, and the D-Link SAP10000 page does not exist. No D-Link advisory, EOL notice or fix was read, so fix stays unknown and nothing is marked verified. Not checked: whether HNAP is exposed on WAN by default, and the public exploit link. Next run: find the D-Link support announcement for DIR-878 and the exploit reference in the NVD entry."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}