D-Link DIR-878 CVE-2026-124563

Requires network reachability to the router's HNAP handler and the ability to send a SetWanSettings request with an oversized Primary/Secondary (DNS) argument; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed. Limiting factors: the affected DIR-878 1.20B05 is end-of-life with no vendor patch, so only owners of this specific unsupported model are exposed; and although the vector is marked AV:N, HNAP is typically a LAN-side service, so remote exploitation across the internet realistically depends on WAN-side remote management being enabled. The evidence scopes impact to availability (service crash), not confidentiality or integrity.

Signals are moderate and partially conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated trigger, but the impact metrics are limited to availability (VA:H) with VC:N/VI:N - i.e. the source assesses this as a denial-of-service/crash, NOT confirmed code execution, despite the CWE-120 buffer-overflow class that could in principle allow more. The input provides no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a notable-but-not-critical priority. Exploit maturity is E:P (proof-of-concept), and the referenced GitHub entry is a PoC reference only, not verified as working exploit code. Net: this is a real issue on an end-of-life device with no vendor fix, but it reads as a DoS-grade bug of limited-prevalence hardware rather than a mass-exploitation priority. Note the tension between AV:N and typical HNAP exposure: HNAP is usually a LAN-facing service, so real-world reach often depends on whether remote management is enabled - verify exposure per deployment.

An attacker with network access to the router's HNAP interface sends a crafted SetWanSettings request with an overlong Primary/Secondary DNS value, overflowing a fixed-size buffer in the HNAP handler and crashing or destabilizing the service. A public PoC reference exists but is not verified as working exploit code, so reliability is unconfirmed. Because no authentication is required (PR:N) and complexity is low (AC:L), triggering the condition is straightforward wherever the HNAP endpoint is reachable.