{"id":"CVE-2026-124563","kind":"vulnerability","aliases":["CVE-2026-124563"],"related":[],"title":"D-Link DIR-878 router: buffer overflow in HNAP lets remote attackers in","description":"A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"A buffer overflow in the SetWanSettings function of the HNAP Handler on the D-Link DIR-878 router (firmware 1.20B05) is triggered by an oversized Primary/Secondary argument. A remote attacker can exploit it, and a public exploit has been released; the sources do not state the impact beyond that.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DIR-878","fixed":[],"affected":"1.20B05 (CVE); all firmware per EoL notice","ecosystem":"vendor"}],"ecosystems":[],"tags":["d-link","dir-878","end-of-life","hnap","infrastructure","routers"],"not_affected_if":["hnap-not-exposed","other-firmware-versions"],"how_to_check":"Check the firmware version on the router admin page (Status or System info). The CVE names 1.20B05, and D-Link's EoL notice covers all DIR-878 revisions, so any DIR-878 (also DIR-878/RE, /RE-CA) should be treated as exposed. Also check whether the web admin/HNAP interface is reachable from the WAN (remote management on).","fix":"No fix: D-Link lists the DIR-878 (all revisions, all firmware) as end-of-life/end-of-service (announcement SAP10475). Replace the router with a supported model.","status":"open","published_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:37+00:00","triaged_at":"2026-11-09T04:26:36+00:00","updated_at":"2026-11-09T04:27:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T04:26:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown; the sources state that the product is no longer supported by the maintainer, so no fixed version is given","reach":"internet","title":"D-Link DIR-878 router: buffer overflow in HNAP lets remote attackers in","impact":"high","summary":"A buffer overflow in the SetWanSettings function of the HNAP Handler on the D-Link DIR-878 router (firmware 1.20B05) is triggered by an oversized Primary/Secondary argument. A remote attacker can exploit it, and a public exploit has been released; the sources do not state the impact beyond that.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["d-link","dir-878","routers","hnap"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"remote attacker overflows a buffer and may run code on the router","analyst_note":"Confirm whether authentication is required for SetWanSettings and whether HNAP is exposed by default; check the NVD entry for CVSS vector and any vendor or replacement guidance.","how_to_check":"- Check the router's firmware version in its admin page (Status or System info) and compare it with `1.20B05`\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","hnap-not-exposed"],"who_is_affected":"Owners of D-Link DIR-878 routers running firmware 1.20B05 that are reachable from the internet or an untrusted network. The sources say the affected product is no longer supported by the maintainer, so no vendor patch is expected. Sources do not say whether the HNAP interface is exposed by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000766,"input_tokens":4579,"output_tokens":617,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether authentication is required for SetWanSettings and whether HNAP is exposed by default; check the NVD entry for CVSS vector and any vendor or replacement guidance.","search":"'-124563':16A,19A '-2026':15A,18A '-878':5A,21A,26B,51B,95C '1.20':54B,96C 'affect':98C,144C 'argument':62B,115C 'attack':13A,65B,122C,140C 'b05':55B,97C 'beyond':83B 'buffer':7A,35B,119C 'compon':108C 'cve':14A,17A 'd':2A,23B,48B,92C 'd-link':1A,22B,47B,91C 'dir':4A,20A,25B,50B,94C 'discov':89C 'end':28B 'end-of-lif':27B 'exploit':67B,72B,128C 'firmwar':53B 'flaw':86C 'function':40B,104C 'handler':44B,110C 'hnap':10A,31B,43B,109C 'impact':82B 'infrastructur':32B 'launch':125C 'let':11A 'life':30B 'link':3A,24B,49B,93C 'longer':149C 'maintain':153C 'manipul':112C 'may':123C,136C 'overflow':8A,36B,120C 'overs':60B 'primary/secondary':61B,116C 'product':145C 'public':71B,134C 'releas':75B,131C 'remot':12A,64B,126C 'result':117C 'router':6A,33B,52B 'secur':85C 'setwanset':39B,105C 'sourc':77B 'state':80B 'support':150C 'trigger':57B 'use':138C 'vulner':101C,142C","nicknames":[],"mitigations":[],"who_affected":"Owners of D-Link DIR-878 routers running firmware 1.20B05 that are reachable from the internet or an untrusted network. The sources say the affected product is no longer supported by the maintainer, so no vendor patch is expected. Sources do not say whether the HNAP interface is exposed by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["dir878"],"ptokens":["878","dir"],"labels":["dir878","dlink","endoflife","high","hnap","infrastructure","routers"],"campaign_type":null,"search_a":"'-124563':16A,19A '-2026':15A,18A '-878':5A,21A 'attack':13A 'buffer':7A 'cve':14A,17A 'd':2A 'd-link':1A 'dir':4A,20A 'hnap':10A 'let':11A 'link':3A 'overflow':8A 'remot':12A 'router':6A","search_b":"'-878':26B,51B '1.20':54B 'argument':62B 'attack':65B 'b05':55B 'beyond':83B 'buffer':35B 'd':23B,48B 'd-link':22B,47B 'dir':25B,50B 'end':28B 'end-of-lif':27B 'exploit':67B,72B 'firmwar':53B 'function':40B 'handler':44B 'hnap':31B,43B 'impact':82B 'infrastructur':32B 'life':30B 'link':24B,49B 'overflow':36B 'overs':60B 'primary/secondary':61B 'public':71B 'releas':75B 'remot':64B 'router':33B,52B 'setwanset':39B 'sourc':77B 'state':80B 'trigger':57B","search_c":"'-878':95C '1.20':96C 'affect':98C,144C 'argument':115C 'attack':122C,140C 'b05':97C 'buffer':119C 'compon':108C 'd':92C 'd-link':91C 'dir':94C 'discov':89C 'exploit':128C 'flaw':86C 'function':104C 'handler':110C 'hnap':109C 'launch':125C 'link':93C 'longer':149C 'maintain':153C 'manipul':112C 'may':123C,136C 'overflow':120C 'primary/secondary':116C 'product':145C 'public':134C 'releas':131C 'remot':126C 'result':117C 'secur':85C 'setwanset':105C 'support':150C 'use':138C 'vulner':101C,142C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T04:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124563","severity":null,"published_at":"2026-11-09T04:17:06+00:00","modified_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:37+00:00","fetched_at":"2026-11-09T04:24:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124563:2241","url":"https://supportannouncement.us.dlink.com/","severity":null,"published_at":"2026-11-09T04:27:38+00:00","modified_at":"2026-11-09T04:27:38+00:00","first_seen_at":"2026-11-09T04:27:38+00:00","fetched_at":"2026-11-09T04:27:38+00:00","note":"NVD page unreadable (JS only), web-cli out of credits. CVSS 4.0 vector from collector: AV:N/PR:N, so unauthenticated per CNA vector (VulDB), availability impact only (VA:H). D-Link announcement list shows SAP10475: DIR-878 EoL/EoS, all firmware, no patch expected. Default HNAP WAN exposure not confirmed. Nothing verified; no PoC link found.","cites":["https://supportannouncement.us.dlink.com/","https://nvd.nist.gov/vuln/detail/CVE-2026-124563"]}],"documents":[{"id":105696,"url":"https://supportannouncement.us.dlink.com/","title":"D-Link security announcements (lists SAP10475: DIR-878 EoL/EoS)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":105697,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124563","title":"NVD CVE-2026-124563","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}