Heap-Based Buffer Overflow in D-Link DIR-878 HNAP Handler
CVE-2026-124560

9.3CRITICAL

Key Information:

Vendor

D-link
Status
Dir-878
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124560?

A vulnerability exists in the D-Link DIR-878 1.20B05 version, specifically within the HNAP Handler's GetCAPTCHAsetting function located in the bin/prog.cgi file. By manipulating the uid argument, an attacker can cause a heap-based buffer overflow, potentially leading to unauthorized access. The attack can be executed remotely, and this vulnerability affects products that are no longer actively supported by the vendor, posing a significant risk to users.

Affected Version(s)

DIR-878 1.20B05

References

https://vuldb.com/vuln/432892
vdb-entrytechnical-description
https://vuldb.com/vuln/432892/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124560
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ha ha-yang (VulDB User)
.