D-LINK DIR-878 · CVE-2026-124562 · Infrastructure
NO FIX YET
A buffer overflow in the SetWanSettings function of the HNAP handler on the D-Link DIR-878 router (firmware 1.20B05) is triggered by oversized ConfigDNS Primary or Secondary values. A remote attacker can use a public exploit to crash or take over the router.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
The sources say this only affects D-Link DIR-878 routers on firmware 1.20B05 that the maintainer no longer supports. Routers that are still supported or run other firmware are not named as affected. Home and small office users who run this router with its HNAP interface reachable from the internet or the local network are the ones exposed.
Not affected if other-firmware, unsupported-product-excluded
Who cares d-link, dir-878, hnap, home-network, router
No fix yet, per the sources.
A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.