CVE-2026-124563: D-Link DIR-878 HNAP SetWanSettings buffer overflow
A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker can launch the attack remotely by sending crafted values in the Primary or Secondary arguments handled by the HNAP SetWanSettings function. No privileges or user interaction are indicated in the provided severity vector.
Is public exploit code available?
Yes. A proof of concept has been released publicly and may be used in attacks.
Which devices are affected and is a vendor fix expected?
The affected product identified is D-Link DIR-878 running version 1.20B05. The issue affects products that are no longer supported by the maintainer, so a vendor patch should not be assumed.
What is the likely security impact?
The supplied severity vector rates availability impact as high, with no stated confidentiality or integrity impact. The flaw is a buffer overflow in the HNAP handler.