EUVD-2026-119787Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device HNAP/prog.cgi interface
-
ExploitSend crafted SetVLANSettings request with oversized VID
-
ExecutionOverflow stack buffer in HNAP handler
-
ImpactCrash service or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to an affected D-Link DIR-878 running firmware 1.20B05 with the HNAP handler reachable, and the attacker must send a request to the SetVLANSettings function of prog.cgi carrying a manipulated VID argument that overflows the stack buffer. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N) no authentication, user interaction, or special timing is indicated, so default-configured, network-reachable devices are exposed. Principal limiting factors: only the DIR-878 1.20B05 build is listed as affected, the device must be reachable on the network (HNAP typically exposed on the LAN side, and only remotely exploitable where WAN/remote management is enabled), and because the product is end-of-life no vendor fix exists - mitigation depends on restricting network exposure or replacing the device. |
| Impact | Signals are mixed and point to a moderate, non-emergency priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, but impact is scoped to availability only (VC:N/VI:N/VA:H), so the supplied score of 7.7 reflects a denial-of-service outcome rather than confirmed code execution - though for a stack-based overflow (CWE-121) in router firmware, code execution cannot be ruled out and is simply not established by the available sources. Exploit maturity is E:P (proof-of-concept), and the intelligence states the PoC is a reference only, not verified as working exploit code; there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency). The most important aggravating factor is that this product is end-of-life and no longer supported, so no vendor patch will be issued. Net: a real but bounded issue - remote-reachable and unauthenticated on an affected device, yet currently availability-only, PoC-stage, and not confirmed exploited; prioritize for mitigation on exposed devices but treat it below confirmed-exploited criticals. Missing EPSS and the unverified PoC are the key data gaps. |
| Exploit ScenarioDerived | An attacker with network reachability to an affected DIR-878 1.20B05 sends a crafted HNAP request to prog.cgi invoking SetVLANSettings with an oversized or malformed VID argument, overflowing a stack buffer. Because the CVSS vector indicates no privileges and no user interaction (PR:N/UI:N) with low complexity, the request can be issued directly against an exposed management interface. A public PoC reference exists but is not verified as working exploit code; the confirmed impact in available sources is loss of availability (device crash/reboot). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 09, 2026
A stack-based buffer overflow in the HNAP handler of D-Link DIR-878 firmware 1.20B05 allows remote, unauthenticated attackers to crash or destabilize the device by sending a crafted SetVLANSettings request to prog.cgi with a manipulated VID argument. The assessed impact is availability only (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/A:H), meaning a successful request can take the router's management service down rather than expose data or permit code execution, which the available assessment does not establish. A public PoC reference exists in a GitHub repository, but it is not verified as working exploit code; there is no CISA KEV entry and the priority is moderate (this_week) rather than emergency. Because the DIR-878 is end-of-life and no longer maintained by D-Link, no vendor fix is expected, so exposure reduction or hardware replacement is the practical path.
Earlier versions of this analysis (1)
A stack-based buffer overflow exists in the HNAP handler of D-Link DIR-878 firmware 1.20B05, where a crafted SOAP request to SetVLANSettings in prog.cgi with an oversized VID argument overflows a fixed-size stack buffer. The flaw is reachable over the network without credentials (the assessed vector is AV:N/AC:L/PR:N/UI:N), and the scored impact is availability-only (A:H, no confidentiality or integrity effect), consistent with a crash or denial-of-service condition of the device's web management service. A public PoC reference exists (a GitHub repository demonstrating the VLAN overflow); it is not verified as working exploit code, and no CISA KEV entry or confirmed in-the-wild exploitation is present in the supplied data. The product is end-of-life, so no vendor patch is expected.
RemediationAI
No vendor-released patch has been identified for CVE-2026-124561: the DIR-878 is end-of-life and D-Link no longer supports it, so no fixed firmware version is published and the only complete remedy per the available information is to retire and replace the device with a currently supported router. If replacement cannot happen immediately, reduce exposure by turning off remote/WAN management and any HNAP or web-administration access from the internet, keeping prog.cgi and the admin interface reachable only from trusted LAN hosts, and blocking inbound access to the device's management ports at the perimeter firewall - the trade-off is that remote administration stops working and local access must come from the trusted segment. Place the router on an isolated network segment or VLAN separate from production systems so that a crash of the HNAP service cannot be used to pivot, accepting the added management complexity and possible loss of convenience features that depend on flat LAN access. Monitor the device for unexpected reboots or management-service outages as an indicator of an attempt, and track the VulDB entries (https://vuldb.com/vuln/432893, https://vuldb.com/cve/CVE-2026-124561) plus the D-Link site (https://www.dlink.com/) for any change in vendor status; scheduling this within a normal weekly remediation cycle is consistent with the moderate this_week priority.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow in prog.cgi, the CGI binary that implements the HNAP (Home Network Administration Protocol) handler on the DIR-878. Within that handler, the SetVLANSettings function processes the VID argument and copies it into a fixed-size stack buffer without validating its length, so an oversized value overwrites adjacent stack memory and, per the assessment, primarily crashes the service. The CVSS vector carries PR:N and UI:N with AC:L/AT:N, so no authentication, user interaction, or unusual timing condition is indicated for a reachable device; the request is delivered over the network to the HNAP endpoint. Practical reachability depends on deployment: HNAP is typically exposed on the LAN side, and remote exploitation from outside requires WAN access or remote management to be enabled on the device. The CVSS 4.0 vector records E:P (proof-of-concept maturity), matching the reference-only GitHub PoC rather than confirmed working exploit code. The CPE entry cpe:2.3:a:d-link:dir-878:*:*:*:*:*:*:*:* uses a wildcard version, while the EUVD entry pins the affected build to 1.20B05; the trigger details beyond the VID argument handling are not described in the available sources.
Know when Dir 878 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Remote, low-complexity, unauthenticated HNAP request (AV:N/AC:L/PR:N/UI:N); sources confirm only an availability impact (A:H) with C:N/I:N, as code execution is not established.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Articles & Coverage 1
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A stack-based buffer overflow in the D-Link DIR-878 router (firmware 1.20B05) can be triggered by an unauthenticated remote attacker to crash or destabilize the device's management service. Because these routers are end-of-life and no fix will be issued, any organization relying on them for network connectivity faces ongoing availability risk at the network edge, though the flaw only disrupts service and does not expose data or enable code execution.
No vendor-released patch identified at time of analysis; interim mitigations include blocking external access to the device management interface, segmenting affected routers from critical assets, and prioritizing hardware replacement or retirement.
Threat Intelligence Overview
NVD
CVE.org
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB