---
id: "CVE-2026-124561"
page: "https://infrastack.ai/live/CVE-2026-124561"
kind: "vulnerability"
aliases: ["CVE-2026-124561"]
title: "D-Link DIR-878 router: stack overflow in HNAP VLAN setting lets attackers run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "DIR-878", "fixed": [], "affected": "1.20B05", "ecosystem": "vendor"}]
ecosystems: []
tags: ["d-link", "dir-878", "firmware", "hnap", "infrastructure", "router"]
not_affected_if: ["not-dir-878", "unsupported-model-replaced"]
published_at: "2026-11-09T04:17:06+00:00"
first_seen_at: "2026-11-09T04:24:36+00:00"
updated_at: "2026-11-09T04:27:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124561", "first_seen_at": "2026-11-09T04:24:36+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124561", "first_seen_at": "2026-11-09T04:27:49+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-124561", "https://vuldb.com/vuln/432893"]}]
exploit_sources: []
---

# D-Link DIR-878 router: stack overflow in HNAP VLAN setting lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-124561 (this .md is for agents)

A stack-based buffer overflow in the SetVLANSettings function of prog.cgi, part of the HNAP handler on the D-Link DIR-878 router, is triggered by a crafted VID argument. The sources say an attacker can launch it remotely and that the exploit is publicly disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DIR-878 affected 1.20B05 fixed no fixed version listed

## How to check

- Check the router label or admin page for model D-Link DIR-878 and firmware 1.20B05 (the only version the CVE names; other DIR-878 firmware is not confirmed either way)
- Check whether the router's web admin/HNAP interface (/HNAP1/) is reachable from the internet (remote management enabled); if so, treat as exposed

## Timeline

- 2026-11-09T04:24:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124561
- 2026-11-09T04:27:49+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-124561 — Read NVD API record (CNA VulDB): no D-Link advisory found; D-Link EOL page fetched did not list DIR-878. PoC repo link 404s. Exa credits exhausted, X not checked. Fix none rests on NVD 'unsupported' statement only, not a vendor page; WAN default reachability unconfirmed. Nothing marked verified.

## Documents

- [advisory] NVD CVE-2026-124561 https://nvd.nist.gov/vuln/detail/CVE-2026-124561
- [mentions] VulDB 432893 https://vuldb.com/vuln/432893

## From the sources

A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_