CVE-2026-124562: D-Link DIR-878 HNAP SetWanSettings buffer overflow
A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
D-Link DIR-878 devices running version 1.20B05 are identified as affected. The issue is remotely reachable through the HNAP Handler.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied severity vector. An attacker can initiate the attack remotely with low attack complexity.
What is the likely impact of successful exploitation?
The supplied rating indicates high availability impact, with no stated confidentiality or integrity impact. The vulnerable parameters are ConfigDNS/Primary and ConfigDNS/Secondary in the SetWanSettings function.
Is public exploit code available?
Yes. The vulnerability data states that an exploit is publicly available and may be used.
What should teams do if they operate an affected device?
The affected products are no longer supported by the maintainer. Prioritize removing or replacing affected DIR-878 devices, and restrict remote network access to their management interfaces while replacement is pending.