---
id: "CVE-2026-124562"
page: "https://infrastack.ai/live/CVE-2026-124562"
kind: "vulnerability"
aliases: ["CVE-2026-124562"]
title: "D-Link DIR-878 router: HNAP buffer overflow lets remote attackers run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "D-Link DIR-878", "fixed": [], "affected": "firmware 1.20B05 (per NVD); D-Link lists all revisions and firmware as EoL", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["d-link", "dir-878", "hnap", "home-network", "infrastructure", "router"]
not_affected_if: ["other-firmware", "unsupported-product-excluded"]
published_at: "2026-11-09T04:17:06+00:00"
first_seen_at: "2026-11-09T04:24:36+00:00"
updated_at: "2026-11-09T04:27:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124562", "first_seen_at": "2026-11-09T04:24:36+00:00"}, {"source": "analyst", "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10475", "first_seen_at": "2026-11-09T04:27:46+00:00", "cites": ["https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10475"]}]
exploit_sources: []
---

# D-Link DIR-878 router: HNAP buffer overflow lets remote attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-124562 (this .md is for agents)

A buffer overflow in the SetWanSettings function of the HNAP handler on the D-Link DIR-878 router (firmware 1.20B05) is triggered by oversized ConfigDNS Primary or Secondary values. A remote attacker can use a public exploit to crash or take over the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:D-Link DIR-878 affected firmware 1.20B05 (per NVD); D-Link lists all revisions and firmware as EoL fixed no fixed version listed

## How to check

Log in to the router admin page and read the firmware version; 1.20B05 is the version named in the CVE. D-Link lists every DIR-878 revision (DIR-878, /RE, /RE-CA) as end-of-life, so treat any DIR-878 as exposed. Also check whether the web admin/HNAP interface is reachable from the internet (remote management enabled) and turn that off.

## Timeline

- 2026-11-09T04:24:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124562
- 2026-11-09T04:27:46+00:00 analyst https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10475 — D-Link bulletin SAP10475 lists DIR-878 as EoL/EoS (support ended 2021-01-31), recommends replacing it, offers no patch. That page does not name this CVE specifically (it lists a range of CVEs), so fix=none rests on the EoL status. NVD page not readable via fetch and Exa out of credits, so no PoC link or posts checked; HNAP default exposure not confirmed. Nothing marked verified.

## Documents

- [advisory] D-Link SAP10475: DIR-878 end-of-life / end-of-service https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10475

## From the sources

A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_