---
id: "CVE-2026-124560"
page: "https://infrastack.ai/live/CVE-2026-124560"
kind: "vulnerability"
aliases: ["CVE-2026-124560"]
title: "D-Link DIR-878 router: heap overflow in HNAP handler lets remote attackers in"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["d-link", "dir-878", "end-of-life", "hnap", "home-router", "infrastructure"]
not_affected_if: ["not-internet-exposed", "other-firmware-version", "replaced-device"]
published_at: "2026-11-09T03:16:38+00:00"
first_seen_at: "2026-11-09T03:24:19+00:00"
updated_at: "2026-11-09T03:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124560", "first_seen_at": "2026-11-09T03:24:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T03:27:20+00:00"}]
exploit_sources: []
---

# D-Link DIR-878 router: heap overflow in HNAP handler lets remote attackers in

Link for people: https://infrastack.ai/live/CVE-2026-124560 (this .md is for agents)

A heap-based buffer overflow in the GetCAPTCHAsetting function of the HNAP handler in bin/prog.cgi on D-Link DIR-878 1.20B05 is triggered by an oversized uid argument. A remote attacker can send a crafted request to the router, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Affected per NVD: DIR-878 firmware 1.20B05. Check the firmware version on the router admin page. Also check whether remote administration (HNAP/web management) is reachable from the WAN side; whether it is on by default is unconfirmed. Until D-Link guidance is found, turn off remote management and consider replacing the router if it is end-of-life.

## Timeline

- 2026-11-09T03:24:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124560
- 2026-11-09T03:27:20+00:00 analyst — Could not reach a primary source: web-cli search returned 402 (Exa credits depleted), NVD page fetch returned only the home page, and the D-Link SAP10000 page does not exist. No D-Link advisory, EOL notice or fix was read, so fix stays unknown and nothing is marked verified. Not checked: whether HNAP is exposed on WAN by default, and the public exploit link. Next run: find the D-Link support announcement for DIR-878 and the exploit reference in the NVD entry.

## From the sources

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_