D-Link DIR-878 CVE-2026-124562

Exploitation requires network reachability to the device's HNAP (Home Network Administration Protocol) handler and the ability to invoke the SetWanSettings function with an attacker-controlled, overlong ConfigDNS/Primary or ConfigDNS/Secondary argument. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication or user interaction is needed and complexity is low. Limiting factors: the HNAP interface must be reachable from the attacker's position (typically LAN-side, or WAN-side only if remote management is exposed), and the device must be a DIR-878 running firmware 1.20B05; the product is end-of-life, so exposure is confined to installations still in service. The scored impact is availability loss (device/service crash), not confidentiality or integrity compromise.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but the impact metrics are VC:N/VI:N/VA:H - only availability is affected, no confidentiality or integrity. Despite the CWE-120 buffer-overflow classification (which can sometimes enable code execution), the vendor-scored vector models this as a crash/denial-of-service condition on the device, not confirmed remote code execution; the available sources do not establish an RCE primitive, so treat the VA:H (device availability) outcome as the confirmed impact. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of active or widespread exploitation. The input marks the PoC as 'reference only, not verified as working exploit code,' and the vuln.today Decision label is 'this_week' - a moderate, not emergency, priority. Net: a genuine unauthenticated remote DoS against an end-of-life consumer router, worth timely attention for anyone still running the device, but not a drop-everything critical given availability-only impact, no confirmed working exploit, and no evidence of in-the-wild use. Key missing data: no EPSS, no KEV, and no CVSS 3.1 vector - exploitation likelihood is inferred only from the 'this_week' label and PoC reference.

A remote attacker on a network path to the router's HNAP interface sends a crafted SetWanSettings HNAP request with an overlong ConfigDNS/Primary or ConfigDNS/Secondary argument, overflowing a stack buffer and crashing the service or device. A public PoC reference exists (GitHub, not verified as working exploit code), so reproduction material is at least partially documented. Per the supplied CVSS vector the confirmed outcome is loss of device availability rather than code execution.