Path Traversal Vulnerability in D-Link DIR-878 Router
CVE-2026-124564

6.9MEDIUM

Key Information:

Vendor

D-link
Status
Dir-878
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124564?

A path traversal vulnerability has been identified in D-Link's DIR-878 router version 1.20B05, specifically in the GetListDirectory function of the bin/prog.cgi file within the HNAP Handler component. This weakness allows attackers to manipulate the ListDirectoryPath argument, potentially leading to unauthorized access to sensitive file system directories. The vulnerability is particularly concerning as it facilitates remote exploitation, and exploits have been publicly disseminated. Importantly, this issue affects versions of the product that are no longer supported by D-Link, highlighting the risks associated with using outdated devices.

Affected Version(s)

DIR-878 1.20B05

References

https://vuldb.com/vuln/432896
vdb-entrytechnical-description
https://vuldb.com/vuln/432896/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124564
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ha ha-yang (VulDB User)
.