CVE-2026-124560
CriticalCVSS 9.8Summary
A vulnerability was found in D-Link DIR-878 version 1.20B05 in the GetCAPTCHAsetting function of bin/prog.cgi (HNAP Handler component). Manipulating the uid argument results in a heap-based buffer overflow. The attack can be initiated remotely and the exploit has been made public.
Risk Assessment
The vulnerability affects a product no longer supported by the maintainer, so patches may not be released. A remote attacker could use the public exploit to trigger a heap overflow and potentially compromise the device.
Recommendation
Replace the D-Link DIR-878 with a supported model or isolate it from external networks. Restrict access to the HNAP interface and monitor traffic to the device.
Other vulnerabilities in D-Link DIR-878
See all- CVE-2026-90693Critical
A flaw has been found in D-Link DIR-878 120B05 impacting the SetWan3Settings function of the WAN Settings component. Manipulation of the Primary/Secondary argument causes a stack-based buffer overflow. Remote exploitation of the attack is possible.
- CVE-2026-90692Critical
A vulnerability was detected in D-Link DIR-878 120B05 affecting the SetDynamicDNSIPv6Settings function of the Dynamic DNS IPv6 Settings component. Manipulation of the IPv6Address/Hostname argument results in a stack-based buffer overflow. The attack may be launched remotely.
Original NVD description (English source)
A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS