---
id: "CVE-2026-129354"
page: "https://infrastack.ai/live/CVE-2026-129354"
kind: "vulnerability"
aliases: ["CVE-2026-129354"]
title: "D-Link DIR-600L router: remote stack overflow in HNAP handler"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "DIR-600L", "fixed": [], "affected": "2.17b02", "ecosystem": "firmware"}]
ecosystems: ["vendor"]
tags: ["d-link", "dir-600l", "end-of-life", "hnap", "home-router", "other"]
not_affected_if: ["other-firmware", "wan-access-disabled"]
published_at: "2026-11-15T01:18:03+00:00"
first_seen_at: "2026-11-15T01:34:15+00:00"
updated_at: "2026-11-15T01:37:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129354", "first_seen_at": "2026-11-15T01:34:15+00:00"}, {"source": "analyst", "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499", "first_seen_at": "2026-11-15T01:37:03+00:00", "cites": ["https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499", "https://vuldb.com/vuln/437417"]}]
exploit_sources: [{"type": "poc", "url": "https://vuldb.com/vuln/437417"}]
---

# D-Link DIR-600L router: remote stack overflow in HNAP handler

Link for people: https://infrastack.ai/live/CVE-2026-129354 (this .md is for agents)

A stack-based buffer overflow in the hnap_main function of the HNAP Handler on the D-Link DIR-600L 2.17b02 router can be triggered remotely. A public exploit has been published, so an attacker could likely run code on the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:DIR-600L affected 2.17b02 fixed no fixed version listed

## How to check

- Find the model and firmware in the router admin page or on its label: DIR-600L with firmware 2.17b02 is the version named (VulDB). Other firmware is not confirmed either way.
- Check whether the router's web/HNAP interface (/HNAP1/) is reachable from the internet (remote management enabled). VulDB says no authentication is needed, so any host that can reach it can attempt the attack.
- Also check any other legacy D-Link DIR-series routers; D-Link lists many as EOL.

## Fix

No fix: D-Link lists DIR-600L (RevB) as end-of-life since 12/01/2016 and says no firmware updates or hotfixes will be released; it recommends retiring and replacing the device (SAP10499, a general EOL notice, not specific to this CVE).

## Timeline

- 2026-11-15T01:34:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129354
- 2026-11-15T01:37:03+00:00 analyst https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499 — VulDB read: unauth remote stack overflow in hnap_main, PoC public on github (link not shown), no known exploitation. D-Link SAP10499 general EOL page: DIR-600L RevB EOL 2016, no firmware updates; fix marked none. No D-Link advisory specific to this CVE found. Sibling of CVE-2026-129353. X not checked.

## Documents

- [advisory] D-Link SAP10499: legacy DIR-series EOL/EOS, DIR-600L RevB EOL 12/01/2016, no firmware updates https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499
- [poc] VulDB VDB-437417: DIR-600L 2.17b02 hnap_main stack overflow (PoC public, unauth, remote) https://vuldb.com/vuln/437417

## From the sources

A flaw has been found in D-Link DIR-600L 2.17b02. Affected by this issue is the function hnap_main of the file htdocs/cgibin of the component HNAP Handler. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_