D-Link DIR-878 CVE-2026-124564

Requires network access to the device's HNAP interface (bin/prog.cgi) on a D-Link DIR-878 running firmware 1.20B05, with exploitation performed by supplying traversal sequences in the ListDirectoryPath argument of the GetListDirectory HNAP action. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is asserted and the default configuration is affected, but note the sources do not describe the trigger mechanism and do not confirm whether an authenticated HNAP session is actually needed, so the unauthenticated assumption should be validated. The main limiting factors are that this affects only the specific DIR-878 1.20B05 model and that the HNAP service must be reachable from the attacker; impact is restricted to information disclosure. Because the product is end-of-life, updating is not available as a fix and mitigation depends on network isolation or retirement of the device.

This is a moderate-severity information-disclosure issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated path with no attack requirements, but impact is limited to low confidentiality only (VC:L, VI:N, VA:N), consistent with a read-only path-traversal file disclosure via the HNAP handler - hence the score of 5.5. Exploit maturity is Proof-of-Concept (E:P) and the description states the exploit has been made public, so publicly available exploit code exists; however there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation at this time. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the picture of a disclosed-but-not-mass-exploited consumer-router bug. A key caveat: HNAP endpoints frequently require authentication, yet the CVSS vector asserts PR:N (unauthenticated); the available sources do not describe the trigger mechanism or confirm whether a session is needed, so the unauthenticated claim rests on the CVSS metric alone and should be verified. Because the device is end-of-life and will not receive a vendor fix, exposed units represent durable, unpatchable risk even though the absolute severity is moderate.

A remote attacker sends a crafted HNAP request to bin/prog.cgi invoking the GetListDirectory function with a manipulated ListDirectoryPath argument containing directory-traversal sequences, causing the device to list or disclose files outside the intended directory. A public proof-of-concept exists (referenced on GitHub), lowering the barrier to reproduction; with AV:N/AC:L the request can be issued over the network with low complexity, though impact is confined to reading information (VC:L), not modifying the device.