{"id":"CVE-2026-124564","kind":"vulnerability","aliases":["CVE-2026-124564"],"related":[],"title":"D-Link DIR-878 router: HNAP path traversal lets remote attackers read files","description":"A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"A path traversal flaw in the HNAP handler of the D-Link DIR-878 router (firmware 1.20B05) lets a remote attacker manipulate the ListDirectoryPath argument of the GetListDirectory function in bin/prog.cgi. The public exploit can reach files outside the intended directory on the device.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["d-link","dir-878","infrastructure","routers","self-hosted"],"not_affected_if":["not-dir-878","supported-firmware"],"how_to_check":"- Check the firmware version in the router admin interface and compare it to `1.20B05`\n- Confirm whether the device is still supported by D-Link; the description says this issue only affects unsupported products","fix":null,"status":"open","published_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:37+00:00","triaged_at":"2026-11-09T04:26:40+00:00","updated_at":"2026-11-09T04:26:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T04:26:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link DIR-878 router: HNAP path traversal lets remote attackers read files","impact":"medium","summary":"A path traversal flaw in the HNAP handler of the D-Link DIR-878 router (firmware 1.20B05) lets a remote attacker manipulate the ListDirectoryPath argument of the GetListDirectory function in bin/prog.cgi. The public exploit can reach files outside the intended directory on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["d-link","dir-878","routers","self-hosted"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"remote attacker reads arbitrary files on the router","analyst_note":"Confirm whether the DIR-878 is out of support and whether a fixed firmware exists, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-124564 and D-Link's advisories.","how_to_check":"- Check the firmware version in the router admin interface and compare it to `1.20B05`\n- Confirm whether the device is still supported by D-Link; the description says this issue only affects unsupported products\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["supported-firmware","not-dir-878"],"who_is_affected":"Affects D-Link DIR-878 routers running firmware 1.20B05, reachable over the network through the HNAP handler. The source says this issue only affects products no longer supported by the maintainer, so teams with supported hardware may be outside its scope. Teams that run this router on a network they expose should replace or isolate it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000776,"input_tokens":4589,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124564':17A,20A '-2026':16A,19A '-878':5A,25B,45B,87C '1.20':48B,88C 'affect':90C,141C 'argument':57B,111C 'attack':12A,53B,120C,137C 'avail':128C 'b05':49B,89C 'bin/prog.cgi':63B,101C 'caus':113C 'compon':104C 'could':133C 'cve':15A,18A 'd':2A,22B,42B,84C 'd-link':1A,21B,41B,83C 'devic':76B 'dir':4A,24B,44B,86C 'directori':73B 'exploit':66B,117C,124C 'file':14A,69B,100C 'firmwar':47B 'flaw':34B 'function':61B,96C 'getlistdirectori':60B,97C 'handler':38B,106C 'hnap':7A,37B,105C 'host':30B 'identifi':81C 'infrastructur':26B 'intend':72B 'issu':93C 'let':10A,50B 'link':3A,23B,43B,85C 'listdirectorypath':56B,112C 'longer':146C 'made':127C 'maintain':150C 'manipul':54B,108C 'outsid':70B 'path':8A,32B,114C 'possibl':122C 'product':142C 'public':65B,131C 'reach':68B 'read':13A 'remot':11A,52B,116C 'router':6A,27B,46B 'self':29B 'self-host':28B 'support':147C 'travers':9A,33B,115C 'use':135C 'vulner':139C 'weak':78C","nicknames":[],"mitigations":[],"who_affected":"Affects D-Link DIR-878 routers running firmware 1.20B05, reachable over the network through the HNAP handler. The source says this issue only affects products no longer supported by the maintainer, so teams with supported hardware may be outside its scope. Teams that run this router on a network they expose should replace or isolate it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dir878","dlink","infrastructure","medium","routers","selfhosted"],"campaign_type":null,"search_a":"'-124564':17A,20A '-2026':16A,19A '-878':5A 'attack':12A 'cve':15A,18A 'd':2A 'd-link':1A 'dir':4A 'file':14A 'hnap':7A 'let':10A 'link':3A 'path':8A 'read':13A 'remot':11A 'router':6A 'travers':9A","search_b":"'-878':25B,45B '1.20':48B 'argument':57B 'attack':53B 'b05':49B 'bin/prog.cgi':63B 'd':22B,42B 'd-link':21B,41B 'devic':76B 'dir':24B,44B 'directori':73B 'exploit':66B 'file':69B 'firmwar':47B 'flaw':34B 'function':61B 'getlistdirectori':60B 'handler':38B 'hnap':37B 'host':30B 'infrastructur':26B 'intend':72B 'let':50B 'link':23B,43B 'listdirectorypath':56B 'manipul':54B 'outsid':70B 'path':32B 'public':65B 'reach':68B 'remot':52B 'router':27B,46B 'self':29B 'self-host':28B 'travers':33B","search_c":"'-878':87C '1.20':88C 'affect':90C,141C 'argument':111C 'attack':120C,137C 'avail':128C 'b05':89C 'bin/prog.cgi':101C 'caus':113C 'compon':104C 'could':133C 'd':84C 'd-link':83C 'dir':86C 'exploit':117C,124C 'file':100C 'function':96C 'getlistdirectori':97C 'handler':106C 'hnap':105C 'identifi':81C 'issu':93C 'link':85C 'listdirectorypath':112C 'longer':146C 'made':127C 'maintain':150C 'manipul':108C 'path':114C 'possibl':122C 'product':142C 'public':131C 'remot':116C 'support':147C 'travers':115C 'use':135C 'vulner':139C 'weak':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T04:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124564","severity":null,"published_at":"2026-11-09T04:17:06+00:00","modified_at":"2026-11-09T04:17:07+00:00","first_seen_at":"2026-11-09T04:24:37+00:00","fetched_at":"2026-11-09T04:24:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}