D-Link DIR-878 CVE-2026-124560

Exploitation requires network reachability to the device's HNAP handler (bin/prog.cgi) on the DIR-878 1.20B05; the trigger is manipulation of the uid argument to the GetCAPTCHAsetting function, causing a heap-based buffer overflow. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so no special configuration is stated as required. The practical limiting factors are: the attacker must be able to reach the HNAP/management interface (typically LAN-side unless remote management is enabled toward the WAN), exploitation is confined to this specific end-of-life model and firmware (1.20B05), and the available PoC is an unverified reference rather than confirmed working exploit code, so reliable code execution is not established.

Signals are mixed and point to a genuinely severe-but-not-yet-urgent issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a remote, low-complexity, unauthenticated flaw with full compromise of the affected system, which is why the base score is 8.9. However, the exploit-maturity metric is E:P (proof-of-concept) and the supplied PoC is a reference only, not verified as working exploit code - so the capability to reliably weaponize it is not confirmed. The vulnerability is NOT in CISA KEV and there is no confirmed active exploitation; no EPSS score was provided, so probability of exploitation cannot be quantified from this data. The vuln.today decision label is 'monitor', not act_now/emergency, consistent with a high technical severity but no evidence of widespread or targeted exploitation. Net: a legitimately high-impact pre-auth memory-corruption bug whose real-world urgency is tempered by unverified exploit code, absent KEV listing, and the fact that the product is end-of-life with a shrinking install base. Key missing data: no EPSS, no independent confirmation the PoC achieves code execution, and no vendor advisory (the product is unsupported).

A remote attacker who can reach the router's HNAP interface sends a crafted HNAP request to bin/prog.cgi invoking GetCAPTCHAsetting with an oversized or malformed uid argument, overflowing a heap buffer. Because the CVSS vector is PR:N/UI:N, no authentication or user interaction is required, so this is reachable by any attacker with network access to the management service. A public PoC reference exists but is not verified as working exploit code, so reliable remote code execution is plausible but not confirmed.