{"id":"CVE-2026-129354","kind":"vulnerability","aliases":["CVE-2026-129354"],"related":[],"title":"D-Link DIR-600L router: remote stack overflow in HNAP handler","description":"A flaw has been found in D-Link DIR-600L 2.17b02. Affected by this issue is the function hnap_main of the file htdocs/cgibin of the component HNAP Handler. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.","summary":"A stack-based buffer overflow in the hnap_main function of the HNAP Handler on the D-Link DIR-600L 2.17b02 router can be triggered remotely. A public exploit has been published, so an attacker could likely run code on the router.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DIR-600L","fixed":[],"affected":"2.17b02","ecosystem":"firmware"}],"ecosystems":["vendor"],"tags":["d-link","dir-600l","end-of-life","hnap","home-router","other"],"not_affected_if":["other-firmware","wan-access-disabled"],"how_to_check":"- Find the model and firmware in the router admin page or on its label: DIR-600L with firmware 2.17b02 is the version named (VulDB). Other firmware is not confirmed either way.\n- Check whether the router's web/HNAP interface (/HNAP1/) is reachable from the internet (remote management enabled). VulDB says no authentication is needed, so any host that can reach it can attempt the attack.\n- Also check any other legacy D-Link DIR-series routers; D-Link lists many as EOL.","fix":"No fix: D-Link lists DIR-600L (RevB) as end-of-life since 12/01/2016 and says no firmware updates or hotfixes will be released; it recommends retiring and replacing the device (SAP10499, a general EOL notice, not specific to this CVE).","status":"open","published_at":"2026-11-15T01:18:03+00:00","first_seen_at":"2026-11-15T01:34:15+00:00","triaged_at":"2026-11-15T01:36:00+00:00","updated_at":"2026-11-15T01:37:03+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-15T01:36:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link DIR-600L router: remote stack overflow in HNAP handler","impact":"high","summary":"A stack-based buffer overflow in the hnap_main function of the HNAP Handler on the D-Link DIR-600L 2.17b02 router can be triggered remotely. A public exploit has been published, so an attacker could likely run code on the router.","audience":"everyone","category":"other","nicknames":[],"who_cares":["d-link","dir-600l","home-router","hnap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the router remotely","analyst_note":"Confirm the fixed firmware version and whether HNAP is exposed on WAN by default; check the D-Link advisory and the exploit publication.","how_to_check":"- Check the firmware version in the router admin interface; the flaw is described for `2.17b02`.\n- Check whether the HNAP service is reachable from the internet on the router's WAN side.","plain_action":"If you own a D-Link DIR-600L router, check its firmware version and turn off remote access to its admin page until the vendor publishes a fix.","product_name":"DIR-600L","needs_analyst":true,"not_affected_if":["other-firmware","wan-access-disabled"],"who_is_affected":"Owners of D-Link DIR-600L routers running firmware 2.17b02, where the HNAP Handler is exposed. Sources do not say whether the flaw is reachable from the WAN side by default, so exposure depends on the device's configuration. Devices not running this firmware are not described as affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000762,"input_tokens":4549,"output_tokens":614,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether HNAP is exposed on WAN by default; check the D-Link advisory and the exploit publication.","search":"'-129354':16A,19A '-2026':15A,18A '2.17':60B,95C '600l':6A,22A,28B,59B,94C 'affect':97C 'attack':75B,127C 'b02':61B,96C 'base':40B,123C 'buffer':41B,124C 'code':79B 'compon':112C 'could':76B 'cve':14A,17A 'd':2A,24B,55B,90C 'd-link':1A,23B,54B,89C 'dir':5A,21A,27B,58B,93C 'dir-600l':4A,20A,26B,57B,92C 'end':30B 'end-of-lif':29B 'execut':115C,130C 'exploit':69B,133C 'file':108C 'flaw':84C 'found':87C 'function':47B,103C 'handler':13A,51B,114C 'hnap':12A,33B,45B,50B,104C,113C 'home':35B 'home-rout':34B 'htdocs/cgibin':109C 'issu':100C 'lead':119C 'life':32B 'like':77B 'link':3A,25B,56B,91C 'main':46B,105C 'manipul':117C 'may':138C 'overflow':10A,42B,125C 'public':68B 'publish':72B,136C 'remot':8A,66B,131C 'router':7A,36B,62B,82B 'run':78B 'stack':9A,39B,122C 'stack-bas':38B,121C 'trigger':65B 'use':140C","nicknames":[],"mitigations":[],"who_affected":"Owners of D-Link DIR-600L routers running firmware 2.17b02 are named as affected by VulDB. The flaw is in hnap_main (htdocs/cgibin, HNAP Handler); VulDB says it needs no authentication and a public proof of concept exists, so exposure is highest where the admin interface is reachable from the internet. D-Link lists the DIR-600L as end of life, so no patch is expected; owners of other models can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-15T01:37:03Z","by":"analyst","doc":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499","run_id":4012}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use a D-Link DIR-600L router, replace it with a currently supported router, because D-Link no longer provides updates for it.","pkeys":["dir600l"],"ptokens":["600l","dir"],"labels":["critical","dir600l","dlink","endoflife","hnap","homerouter","other","vendor"],"campaign_type":null,"search_a":"'-129354':16A,19A '-2026':15A,18A '600l':6A,22A 'cve':14A,17A 'd':2A 'd-link':1A 'dir':5A,21A 'dir-600l':4A,20A 'handler':13A 'hnap':12A 'link':3A 'overflow':10A 'remot':8A 'router':7A 'stack':9A","search_b":"'2.17':60B '600l':28B,59B 'attack':75B 'b02':61B 'base':40B 'buffer':41B 'code':79B 'could':76B 'd':24B,55B 'd-link':23B,54B 'dir':27B,58B 'dir-600l':26B,57B 'end':30B 'end-of-lif':29B 'exploit':69B 'function':47B 'handler':51B 'hnap':33B,45B,50B 'home':35B 'home-rout':34B 'life':32B 'like':77B 'link':25B,56B 'main':46B 'overflow':42B 'public':68B 'publish':72B 'remot':66B 'router':36B,62B,82B 'run':78B 'stack':39B 'stack-bas':38B 'trigger':65B","search_c":"'2.17':95C '600l':94C 'affect':97C 'attack':127C 'b02':96C 'base':123C 'buffer':124C 'compon':112C 'd':90C 'd-link':89C 'dir':93C 'dir-600l':92C 'execut':115C,130C 'exploit':133C 'file':108C 'flaw':84C 'found':87C 'function':103C 'handler':114C 'hnap':104C,113C 'htdocs/cgibin':109C 'issu':100C 'lead':119C 'link':91C 'main':105C 'manipul':117C 'may':138C 'overflow':125C 'publish':136C 'remot':131C 'stack':122C 'stack-bas':121C 'use':140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T01:18:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-129354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129354","severity":null,"published_at":"2026-11-15T01:18:03+00:00","modified_at":"2026-11-15T01:18:03+00:00","first_seen_at":"2026-11-15T01:34:15+00:00","fetched_at":"2026-11-15T01:34:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129354:4012","url":"https://vuldb.com/vuln/437417","severity":null,"published_at":"2026-11-15T01:37:03+00:00","modified_at":"2026-11-15T01:37:03+00:00","first_seen_at":"2026-11-15T01:37:03+00:00","fetched_at":"2026-11-15T01:37:03+00:00","note":"VulDB read: unauth remote stack overflow in hnap_main, PoC public on github (link not shown), no known exploitation. D-Link SAP10499 general EOL page: DIR-600L RevB EOL 2016, no firmware updates; fix marked none. No D-Link advisory specific to this CVE found. Sibling of CVE-2026-129353. X not checked.","cites":["https://vuldb.com/vuln/437417","https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499"]}],"documents":[{"id":159861,"url":"https://vuldb.com/vuln/437417","title":"VulDB VDB-437417: DIR-600L 2.17b02 hnap_main stack overflow (PoC public, unauth, remote)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":159547,"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499","title":"D-Link SAP10499: legacy DIR-series EOL/EOS, DIR-600L RevB EOL 12/01/2016, no firmware updates","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://vuldb.com/vuln/437417"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}