D-Link DIR-600L CVE-2026-129354

Exploitation requires network reachability to the device's HNAP Handler endpoint (the cgibin hnap_main function), reached via the web/management interface; the realistic worst case is a DIR-600L with the HNAP/HTTP interface exposed to the WAN, while LAN-only exposure limits attackers to the local network segment. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. The precise trigger (which SOAPAction field or parameter overflows the buffer) is referenced by the public advisory title (HNAP SOAPAction) but the exact overflowing input is not detailed in the available sources. The main limiting factor is deployment scope: DIR-600L is an end-of-life model with a shrinking install base, and exploitation impact is confined to affected D-Link DIR-600L 2.17b02 firmware.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with all vulnerable-system and subsequent-system impacts High) describes a remotely reachable, unauthenticated, low-complexity stack-based buffer overflow in the HNAP handler, which is consistent with the description ('attack can be executed remotely'). The vuln.today decision label is act_now, which signals high urgency. However, these signals should be weighed against mitigating real-world factors: exploitation status is only a published PoC reference (Exploitation Flag E:P / 'Proof-of-Concept'), NOT confirmed active exploitation - this CVE is not listed in CISA KEV and no EPSS probability was provided in the input, so widespread opportunistic exploitation cannot be asserted. The D-Link DIR-600L is an end-of-life consumer/SOHO router with a small, declining deployment footprint, so despite the 9.3 score the aggregate real-world risk is bounded by product prevalence and exposure (routers with WAN-side HNAP exposed are the primary at-risk population). Net: a genuinely severe, trivially exploitable flaw on affected devices, but the act_now label reflects severity and ease of exploitation rather than evidence of mass in-the-wild campaigns; prioritize for any surviving DIR-600L deployments, especially WAN-exposed ones.

An attacker with network reach to the device (notably if the HNAP/web management interface is exposed to the WAN) sends a crafted HNAP SOAP request with an oversized SOAPAction or parameter value to the cgibin hnap_main function, overflowing a stack buffer. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, enabling remote code execution or device takeover. A public PoC reference exists (GitHub advisory), but it is not verified as working exploit code, so reliability of a weaponized exploit is unconfirmed.