CVE-2026-124561: D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow
A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. Exploitation targets the VID argument handled by the HNAP SetVLANSettings function in prog.cgi.
How likely is exploitation in practice?
Public exploit disclosure is indicated, and the vulnerability is rated high severity with low attack complexity. This makes exposed, reachable devices a practical target.
Is a vendor-supported fix expected?
The affected products are no longer supported by the maintainer. The provided information does not identify an updated fixed version.
What should be done if the device cannot be replaced immediately?
The data confirms remote exploitation through the HNAP handler but does not provide a specific mitigation. Prioritize removing affected devices from untrusted network exposure and replacing them with supported hardware.