---
id: "CVE-2026-124563"
page: "https://infrastack.ai/live/CVE-2026-124563"
kind: "vulnerability"
aliases: ["CVE-2026-124563"]
title: "D-Link DIR-878 router: buffer overflow in HNAP lets remote attackers in"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "DIR-878", "fixed": [], "affected": "1.20B05 (CVE); all firmware per EoL notice", "ecosystem": "vendor"}]
ecosystems: []
tags: ["d-link", "dir-878", "end-of-life", "hnap", "infrastructure", "routers"]
not_affected_if: ["hnap-not-exposed", "other-firmware-versions"]
published_at: "2026-11-09T04:17:06+00:00"
first_seen_at: "2026-11-09T04:24:37+00:00"
updated_at: "2026-11-09T04:27:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124563", "first_seen_at": "2026-11-09T04:24:37+00:00"}, {"source": "analyst", "url": "https://supportannouncement.us.dlink.com/", "first_seen_at": "2026-11-09T04:27:38+00:00", "cites": ["https://supportannouncement.us.dlink.com/", "https://nvd.nist.gov/vuln/detail/CVE-2026-124563"]}]
exploit_sources: []
---

# D-Link DIR-878 router: buffer overflow in HNAP lets remote attackers in

Link for people: https://infrastack.ai/live/CVE-2026-124563 (this .md is for agents)

A buffer overflow in the SetWanSettings function of the HNAP Handler on the D-Link DIR-878 router (firmware 1.20B05) is triggered by an oversized Primary/Secondary argument. A remote attacker can exploit it, and a public exploit has been released; the sources do not state the impact beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DIR-878 affected 1.20B05 (CVE); all firmware per EoL notice fixed no fixed version listed

## How to check

Check the firmware version on the router admin page (Status or System info). The CVE names 1.20B05, and D-Link's EoL notice covers all DIR-878 revisions, so any DIR-878 (also DIR-878/RE, /RE-CA) should be treated as exposed. Also check whether the web admin/HNAP interface is reachable from the WAN (remote management on).

## Fix

No fix: D-Link lists the DIR-878 (all revisions, all firmware) as end-of-life/end-of-service (announcement SAP10475). Replace the router with a supported model.

## Timeline

- 2026-11-09T04:24:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124563
- 2026-11-09T04:27:38+00:00 analyst https://supportannouncement.us.dlink.com/ — NVD page unreadable (JS only), web-cli out of credits. CVSS 4.0 vector from collector: AV:N/PR:N, so unauthenticated per CNA vector (VulDB), availability impact only (VA:H). D-Link announcement list shows SAP10475: DIR-878 EoL/EoS, all firmware, no patch expected. Default HNAP WAN exposure not confirmed. Nothing verified; no PoC link found.

## Documents

- [advisory] D-Link security announcements (lists SAP10475: DIR-878 EoL/EoS) https://supportannouncement.us.dlink.com/
- [describes] NVD CVE-2026-124563 https://nvd.nist.gov/vuln/detail/CVE-2026-124563

## From the sources

A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_