{"id":"CVE-2026-124562","kind":"vulnerability","aliases":["CVE-2026-124562"],"related":[],"title":"D-Link DIR-878 router: HNAP buffer overflow lets remote attackers run code","description":"A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"A buffer overflow in the SetWanSettings function of the HNAP handler on the D-Link DIR-878 router (firmware 1.20B05) is triggered by oversized ConfigDNS Primary or Secondary values. A remote attacker can use a public exploit to crash or take over the router.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"D-Link DIR-878","fixed":[],"affected":"firmware 1.20B05 (per NVD); D-Link lists all revisions and firmware as EoL","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","dir-878","hnap","home-network","infrastructure","router"],"not_affected_if":["other-firmware","unsupported-product-excluded"],"how_to_check":"Log in to the router admin page and read the firmware version; 1.20B05 is the version named in the CVE. D-Link lists every DIR-878 revision (DIR-878, /RE, /RE-CA) as end-of-life, so treat any DIR-878 as exposed. Also check whether the web admin/HNAP interface is reachable from the internet (remote management enabled) and turn that off.","fix":null,"status":"open","published_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:36+00:00","triaged_at":"2026-11-09T04:26:36+00:00","updated_at":"2026-11-09T04:27:46+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-09T04:26:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link DIR-878 router: HNAP buffer overflow lets remote attackers run code","impact":"high","summary":"A buffer overflow in the SetWanSettings function of the HNAP handler on the D-Link DIR-878 router (firmware 1.20B05) is triggered by oversized ConfigDNS Primary or Secondary values. A remote attacker can use a public exploit to crash or take over the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["d-link","dir-878","router","hnap","home-network"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Remote attacker runs code on the router","analyst_note":"Confirm whether a supported firmware fix exists and whether HNAP is exposed by default at https://nvd.nist.gov/vuln/detail/CVE-2026-124562.","how_to_check":"- Check the router's firmware version in its admin interface and confirm whether it reads `1.20B05`\n- Check whether the router is still supported by D-Link, since the sources say this issue only affects unsupported products","plain_action":"If you own a D-Link DIR-878 router, check its firmware version; the vendor no longer supports this model, so replacing the router is the only safe option according to the sources.","product_name":"D-Link DIR-878","needs_analyst":true,"not_affected_if":["unsupported-product-excluded","other-firmware"],"who_is_affected":"The sources say this only affects D-Link DIR-878 routers on firmware 1.20B05 that the maintainer no longer supports. Routers that are still supported or run other firmware are not named as affected. Home and small office users who run this router with its HNAP interface reachable from the internet or the local network are the ones exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000794,"input_tokens":4583,"output_tokens":671,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a supported firmware fix exists and whether HNAP is exposed by default at https://nvd.nist.gov/vuln/detail/CVE-2026-124562.","search":"'-124562':17A,20A '-2026':16A,19A '-878':5A,25A,30B,54B,92C '1.20':57B,93C 'affect':95C,133C 'argument':109C 'attack':12A,70B,116C 'avail':125C 'b05':58B,94C 'buffer':8A,38B,113C 'code':14A 'compon':102C 'configdn':63B 'configdns/primary/configdns/secondary':110C 'crash':77B 'cve':15A,18A 'd':2A,22A,27B,51B,89C 'd-link':1A,21A,26B,50B,88C 'dir':4A,24A,29B,53B,91C 'exploit':75B,122C 'firmwar':56B 'function':43B,98C 'handler':47B,104C 'hnap':7A,31B,46B,103C 'home':33B 'home-network':32B 'identifi':86C 'infrastructur':35B 'initi':119C 'lead':111C 'let':10A 'link':3A,23A,28B,52B,90C 'longer':138C 'maintain':142C 'manipul':106C 'may':117C 'might':127C 'network':34B 'overflow':9A,39B,114C 'overs':62B 'primari':64B 'product':134C 'public':74B,124C 'remot':11A,69B,120C 'router':6A,36B,55B,82B 'run':13A 'secondari':66B 'setwanset':42B,99C 'support':139C 'take':79B 'trigger':60B 'use':72B,129C 'valu':67B 'vulner':84C,131C","nicknames":[],"mitigations":[],"who_affected":"The sources say this only affects D-Link DIR-878 routers on firmware 1.20B05 that the maintainer no longer supports. Routers that are still supported or run other firmware are not named as affected. Home and small office users who run this router with its HNAP interface reachable from the internet or the local network are the ones exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a D-Link DIR-878 router, check its firmware version; the vendor no longer supports this model, so replacing the router is the only safe option according to the sources.","pkeys":["dir878","dlinkdir878"],"ptokens":["878","dir","link"],"labels":["dir878","dlink","high","hnap","homenetwork","infrastructure","router","vendor"],"campaign_type":null,"search_a":"'-124562':17A,20A '-2026':16A,19A '-878':5A,25A 'attack':12A 'buffer':8A 'code':14A 'cve':15A,18A 'd':2A,22A 'd-link':1A,21A 'dir':4A,24A 'hnap':7A 'let':10A 'link':3A,23A 'overflow':9A 'remot':11A 'router':6A 'run':13A","search_b":"'-878':30B,54B '1.20':57B 'attack':70B 'b05':58B 'buffer':38B 'configdn':63B 'crash':77B 'd':27B,51B 'd-link':26B,50B 'dir':29B,53B 'exploit':75B 'firmwar':56B 'function':43B 'handler':47B 'hnap':31B,46B 'home':33B 'home-network':32B 'infrastructur':35B 'link':28B,52B 'network':34B 'overflow':39B 'overs':62B 'primari':64B 'public':74B 'remot':69B 'router':36B,55B,82B 'secondari':66B 'setwanset':42B 'take':79B 'trigger':60B 'use':72B 'valu':67B","search_c":"'-878':92C '1.20':93C 'affect':95C,133C 'argument':109C 'attack':116C 'avail':125C 'b05':94C 'buffer':113C 'compon':102C 'configdns/primary/configdns/secondary':110C 'd':89C 'd-link':88C 'dir':91C 'exploit':122C 'function':98C 'handler':104C 'hnap':103C 'identifi':86C 'initi':119C 'lead':111C 'link':90C 'longer':138C 'maintain':142C 'manipul':106C 'may':117C 'might':127C 'overflow':114C 'product':134C 'public':124C 'remot':120C 'setwanset':99C 'support':139C 'use':129C 'vulner':84C,131C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T04:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124562","severity":null,"published_at":"2026-11-09T04:17:06+00:00","modified_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:36+00:00","fetched_at":"2026-11-09T04:24:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124562:2242","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10475","severity":null,"published_at":"2026-11-09T04:27:46+00:00","modified_at":"2026-11-09T04:27:46+00:00","first_seen_at":"2026-11-09T04:27:46+00:00","fetched_at":"2026-11-09T04:27:46+00:00","note":"D-Link bulletin SAP10475 lists DIR-878 as EoL/EoS (support ended 2021-01-31), recommends replacing it, offers no patch. That page does not name this CVE specifically (it lists a range of CVEs), so fix=none rests on the EoL status. NVD page not readable via fetch and Exa out of credits, so no PoC link or posts checked; HNAP default exposure not confirmed. Nothing marked verified.","cites":["https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10475"]}],"documents":[{"id":105698,"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10475","title":"D-Link SAP10475: DIR-878 end-of-life / end-of-service","kind":"vendor","source":"analyst","publisher":null,"text":"DIR-878 all revisions, all firmware: EoL/EoS (end of support 01/31/2021). D-Link recommends discontinuing use and replacing the device. No patch provided. If kept: change web interface password, enable strong Wi-Fi encryption.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}