DIR-878 · CVE-2026-124561 · Infrastructure
NO FIX YET
A stack-based buffer overflow in the SetVLANSettings function of prog.cgi, part of the HNAP handler on the D-Link DIR-878 router, is triggered by a crafted VID argument. The sources say an attacker can launch it remotely and that the exploit is publicly disclosed.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Confirmed affected: D-Link DIR-878 firmware 1.20B05. NVD says the product is no longer supported by the maintainer, so a vendor patch is not expected; I did not find a D-Link page confirming this or any replacement firmware. Whether the HNAP handler is reachable from the WAN by default is not stated in the sources. Teams without this model can skip it.
Not affected if not-dir-878, unsupported-model-replaced
Who cares d-link, dir-878, firmware, hnap, router
No fix yet, per the sources.
A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.