CVE-2026-124564 · Infrastructure
NO FIX YET
A path traversal flaw in the HNAP handler of the D-Link DIR-878 router (firmware 1.20B05) lets a remote attacker manipulate the ListDirectoryPath argument of the GetListDirectory function in bin/prog.cgi. The public exploit can reach files outside the intended directory on the device.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affects D-Link DIR-878 routers running firmware 1.20B05, reachable over the network through the HNAP handler. The source says this issue only affects products no longer supported by the maintainer, so teams with supported hardware may be outside its scope. Teams that run this router on a network they expose should replace or isolate it.
Not affected if not-dir-878, supported-firmware
Who cares d-link, dir-878, routers, self-hosted
1.20B05No fix yet, per the sources.
A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.