{"id":"CVE-2026-124561","kind":"vulnerability","aliases":["CVE-2026-124561"],"related":[],"title":"D-Link DIR-878 router: stack overflow in HNAP VLAN setting lets attackers run code","description":"A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"A stack-based buffer overflow in the SetVLANSettings function of prog.cgi, part of the HNAP handler on the D-Link DIR-878 router, is triggered by a crafted VID argument. The sources say an attacker can launch it remotely and that the exploit is publicly disclosed.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DIR-878","fixed":[],"affected":"1.20B05","ecosystem":"vendor"}],"ecosystems":[],"tags":["d-link","dir-878","firmware","hnap","infrastructure","router"],"not_affected_if":["not-dir-878","unsupported-model-replaced"],"how_to_check":"- Check the router label or admin page for model D-Link DIR-878 and firmware 1.20B05 (the only version the CVE names; other DIR-878 firmware is not confirmed either way)\n- Check whether the router's web admin/HNAP interface (/HNAP1/) is reachable from the internet (remote management enabled); if so, treat as exposed","fix":null,"status":"open","published_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:36+00:00","triaged_at":"2026-11-09T04:26:36+00:00","updated_at":"2026-11-09T04:27:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T04:26:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link DIR-878 router: stack overflow in HNAP VLAN setting lets attackers run code","impact":"high","summary":"A stack-based buffer overflow in the SetVLANSettings function of prog.cgi, part of the HNAP handler on the D-Link DIR-878 router, is triggered by a crafted VID argument. The sources say an attacker can launch it remotely and that the exploit is publicly disclosed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["d-link","dir-878","router","hnap","firmware"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"attacker may run code on the router remotely","analyst_note":"Confirm from the NVD page whether the HNAP handler is reachable from WAN by default and whether any replacement firmware exists; the sources state no fix.","how_to_check":"- Identify whether any router in use is a D-Link DIR-878 running firmware 1.20B05\n- Check the router's model and firmware version on its admin page or label\n- unknown for any further check the sources do not describe","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-dir-878","unsupported-model-replaced"],"who_is_affected":"The sources say this affects D-Link DIR-878 firmware 1.20B05 and that the product is no longer supported by the maintainer, so no vendor patch is expected. Any network that still runs this router is exposed to remote triggering of the HNAP handler. Teams that do not run this model can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4584,"output_tokens":602,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm from the NVD page whether the HNAP handler is reachable from WAN by default and whether any replacement firmware exists; the sources state no fix.","search":"'-124561':19A,22A '-2026':18A,21A '-878':5A,24A,29B,57B,91C '1.20':92C 'affect':142C 'argument':65B,113C 'attack':14A,70B,124C 'b05':93C 'base':37B,120C 'buffer':38B,121C 'code':16A 'compon':105C 'craft':63B 'cve':17A,20A 'd':2A,26B,54B,88C 'd-link':1A,25B,53B,87C 'determin':85C 'dir':4A,23A,28B,56B,90C 'disclos':81B,134C 'execut':108C 'exploit':78B,130C 'file':101C 'firmwar':30B 'function':43B,97C 'handler':50B,107C 'hnap':10A,31B,49B,106C 'impact':95C 'infrastructur':32B 'launch':72B,127C 'lead':116C 'let':13A 'link':3A,27B,55B,89C 'longer':147C 'maintain':151C 'manipul':110C 'may':136C 'overflow':8A,39B,122C 'part':46B 'product':143C 'prog.cgi':45B,102C 'public':80B,133C 'remot':74B,128C 'router':6A,33B,58B 'run':15A 'say':68B 'set':12A 'setvlanset':42B,98C 'sourc':67B 'stack':7A,36B,119C 'stack-bas':35B,118C 'support':148C 'trigger':60B 'util':138C 'vid':64B,114C 'vlan':11A 'vulner':83C,140C","nicknames":[],"mitigations":[],"who_affected":"Confirmed affected: D-Link DIR-878 firmware 1.20B05. NVD says the product is no longer supported by the maintainer, so a vendor patch is not expected; I did not find a D-Link page confirming this or any replacement firmware. Whether the HNAP handler is reachable from the WAN by default is not stated in the sources. Teams without this model can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["dir878"],"ptokens":["878","dir"],"labels":["dir878","dlink","firmware","high","hnap","infrastructure","router"],"campaign_type":null,"search_a":"'-124561':19A,22A '-2026':18A,21A '-878':5A,24A 'attack':14A 'code':16A 'cve':17A,20A 'd':2A 'd-link':1A 'dir':4A,23A 'hnap':10A 'let':13A 'link':3A 'overflow':8A 'router':6A 'run':15A 'set':12A 'stack':7A 'vlan':11A","search_b":"'-878':29B,57B 'argument':65B 'attack':70B 'base':37B 'buffer':38B 'craft':63B 'd':26B,54B 'd-link':25B,53B 'dir':28B,56B 'disclos':81B 'exploit':78B 'firmwar':30B 'function':43B 'handler':50B 'hnap':31B,49B 'infrastructur':32B 'launch':72B 'link':27B,55B 'overflow':39B 'part':46B 'prog.cgi':45B 'public':80B 'remot':74B 'router':33B,58B 'say':68B 'setvlanset':42B 'sourc':67B 'stack':36B 'stack-bas':35B 'trigger':60B 'vid':64B","search_c":"'-878':91C '1.20':92C 'affect':142C 'argument':113C 'attack':124C 'b05':93C 'base':120C 'buffer':121C 'compon':105C 'd':88C 'd-link':87C 'determin':85C 'dir':90C 'disclos':134C 'execut':108C 'exploit':130C 'file':101C 'function':97C 'handler':107C 'hnap':106C 'impact':95C 'launch':127C 'lead':116C 'link':89C 'longer':147C 'maintain':151C 'manipul':110C 'may':136C 'overflow':122C 'product':143C 'prog.cgi':102C 'public':133C 'remot':128C 'setvlanset':98C 'stack':119C 'stack-bas':118C 'support':148C 'util':138C 'vid':114C 'vulner':83C,140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T04:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124561","severity":null,"published_at":"2026-11-09T04:17:06+00:00","modified_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:36+00:00","fetched_at":"2026-11-09T04:24:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124561:2243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124561","severity":null,"published_at":"2026-11-09T04:27:49+00:00","modified_at":"2026-11-09T04:27:49+00:00","first_seen_at":"2026-11-09T04:27:49+00:00","fetched_at":"2026-11-09T04:27:49+00:00","note":"Read NVD API record (CNA VulDB): no D-Link advisory found; D-Link EOL page fetched did not list DIR-878. PoC repo link 404s. Exa credits exhausted, X not checked. Fix none rests on NVD 'unsupported' statement only, not a vendor page; WAN default reachability unconfirmed. Nothing marked verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-124561","https://vuldb.com/vuln/432893"]}],"documents":[{"id":105699,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124561","title":"NVD CVE-2026-124561","kind":"advisory","source":"analyst","publisher":null,"text":"A vulnerability was determined in D-Link DIR-878 1.20B05. Function SetVLANSettings of prog.cgi (HNAP Handler); manipulation of argument VID leads to stack-based buffer overflow. Attack can be launched remotely. Exploit publicly disclosed. Only affects products no longer supported by the maintainer. References: github.com/Zimo-666/DIR-878-cves (03-settriggeradic-vlan-stack-overflow, now 404), vuldb.com/vuln/432893, dlink.com.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":105700,"url":"https://vuldb.com/vuln/432893","title":"VulDB 432893","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}