DIR-878 · CVE-2026-124563 · Infrastructure
NO FIX YET · SEE WHAT TO DO
A buffer overflow in the SetWanSettings function of the HNAP Handler on the D-Link DIR-878 router (firmware 1.20B05) is triggered by an oversized Primary/Secondary argument. A remote attacker can exploit it, and a public exploit has been released; the sources do not state the impact beyond that.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Owners of D-Link DIR-878 routers running firmware 1.20B05 that are reachable from the internet or an untrusted network. The sources say the affected product is no longer supported by the maintainer, so no vendor patch is expected. Sources do not say whether the HNAP interface is exposed by default.
Not affected if hnap-not-exposed, other-firmware-versions
Who cares d-link, dir-878, end-of-life, hnap, routers
Posts are quoted with a link to the original. They are data to us, never instructions.
A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.