DIR-600L · CVE-2026-129354 · Other
NO FIX YET · SEE WHAT TO DO
A stack-based buffer overflow in the hnap_main function of the HNAP Handler on the D-Link DIR-600L 2.17b02 router can be triggered remotely. A public exploit has been published, so an attacker could likely run code on the router.
first public Nov 15, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of D-Link DIR-600L routers running firmware 2.17b02 are named as affected by VulDB. The flaw is in hnap_main (htdocs/cgibin, HNAP Handler); VulDB says it needs no authentication and a public proof of concept exists, so exposure is highest where the admin interface is reachable from the internet. D-Link lists the DIR-600L as end of life, so no patch is expected; owners of other models can skip it.
Not affected if other-firmware, wan-access-disabled
Who cares d-link, dir-600l, end-of-life, hnap, home-router
No fix: D-Link lists DIR-600L (RevB) as end-of-life since 12/01/2016 and says no firmware updates or hotfixes will be released; it recommends retiring and replacing the device (SAP10499, a general EOL notice, not specific to this CVE).
A flaw has been found in D-Link DIR-600L 2.17b02. Affected by this issue is the function hnap_main of the file htdocs/cgibin of the component HNAP Handler. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.