CVE-2026-124564: D-Link DIR-878 HNAP prog.cgi GetListDirectory path traversal
A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
D-Link DIR-878 devices running version 1.20B05 are identified as affected. The vulnerable HNAP Handler function can be exploited remotely, and no authentication or user interaction requirements are indicated by the supplied severity vector.
Is public exploit code available?
Yes. The exploit has been made publicly available, so affected internet-reachable devices may face a higher likelihood of exploitation.
What should teams do if they cannot patch?
The affected products are no longer supported by the maintainer. If an update is unavailable, reduce exposure by preventing untrusted remote access to the device's HNAP interface and plan to replace affected devices.