EUVD-2026-119786
GHSA-7474-5gjp-gr7m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HNAP service on DIR-878
-
DeliverySend crafted GetCAPTCHAsetting request
-
ExploitOverflow heap via oversized uid
-
ExecutionCorrupt memory in prog.cgi
-
ImpactExecute attacker code on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HNAP handler (bin/prog.cgi) on the DIR-878 1.20B05; the trigger is manipulation of the uid argument to the GetCAPTCHAsetting function, causing a heap-based buffer overflow. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so no special configuration is stated as required. The practical limiting factors are: the attacker must be able to reach the HNAP/management interface (typically LAN-side unless remote management is enabled toward the WAN), exploitation is confined to this specific end-of-life model and firmware (1.20B05), and the available PoC is an unverified reference rather than confirmed working exploit code, so reliable code execution is not established. |
| Impact | Signals are mixed and point to a genuinely severe-but-not-yet-urgent issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a remote, low-complexity, unauthenticated flaw with full compromise of the affected system, which is why the base score is 8.9. However, the exploit-maturity metric is E:P (proof-of-concept) and the supplied PoC is a reference only, not verified as working exploit code - so the capability to reliably weaponize it is not confirmed. The vulnerability is NOT in CISA KEV and there is no confirmed active exploitation; no EPSS score was provided, so probability of exploitation cannot be quantified from this data. The vuln.today decision label is 'monitor', not act_now/emergency, consistent with a high technical severity but no evidence of widespread or targeted exploitation. Net: a legitimately high-impact pre-auth memory-corruption bug whose real-world urgency is tempered by unverified exploit code, absent KEV listing, and the fact that the product is end-of-life with a shrinking install base. Key missing data: no EPSS, no independent confirmation the PoC achieves code execution, and no vendor advisory (the product is unsupported). |
| Exploit ScenarioDerived | A remote attacker who can reach the router's HNAP interface sends a crafted HNAP request to bin/prog.cgi invoking GetCAPTCHAsetting with an oversized or malformed uid argument, overflowing a heap buffer. Because the CVSS vector is PR:N/UI:N, no authentication or user interaction is required, so this is reachable by any attacker with network access to the management service. A public PoC reference exists but is not verified as working exploit code, so reliable remote code execution is plausible but not confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 09, 2026
A heap-based buffer overflow in the HNAP handler of D-Link DIR-878 firmware 1.20B05 allows remote attackers to corrupt heap memory by manipulating the uid argument passed to the GetCAPTCHAsetting function in bin/prog.cgi, with potential for full confidentiality, integrity and availability impact on the device (CVSS 3.1 9.8-equivalent metrics of AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). Per the assessed vector, no authentication or user interaction is required, although practical exploitation depends on the attacker being able to reach the HNAP management interface - normally LAN-side unless remote management is exposed toward the WAN. The DIR-878 is end-of-life and no longer maintained, so no vendor patch is expected; a public PoC reference exists in a GitHub repository, but it is not verified as working exploit code, and the current priority decision is monitor with no confirmed active exploitation (no CISA KEV listing).
RemediationAI
No vendor-released patch or fixed firmware is identified: the DIR-878 is end-of-life and no longer supported by D-Link, so upgrading to a patched 1.20B05 successor is not an option and the only complete remedy is replacing the device with a model still receiving security fixes. Until replacement, compensate by removing reachability to the HNAP handler: disable remote/WAN management on the router and block inbound access to its web/HNAP interface at the upstream firewall (trade-off: you lose remote administration and must manage the device from the LAN or a VPN). Further restrict which LAN hosts or VLANs can reach bin/prog.cgi and TCP/80/443 on the device via ACLs or network segmentation (trade-off: additional management overhead and possible breakage of HNAP-based management utilities or ISP auto-configuration that relies on HNAP). If the firmware exposes a toggle to disable HNAP or the CAPTCHA/settings web surface, turn it off (trade-off: some D-Link setup wizards and companion apps stop functioning). Monitor the VulDB entries (https://vuldb.com/vuln/432892 and https://vuldb.com/cve/CVE-2026-124560) and the public PoC reference (https://github.com/Zimo-666/DIR-878-cves/tree/main/01-captcha-uid-heap-overflow) for changes in exploit maturity; that reference is not verified as working exploit code, but because no patch will arrive, exposure reduction must be network-based.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The DIR-878 is a consumer/SOHO wireless router whose web management plane includes HNAP (Home Network Administration Protocol), a SOAP-style request/response protocol historically used by D-Link and other vendors for device discovery and configuration. Requests are dispatched through the CGI binary bin/prog.cgi, and the GetCAPTCHAsetting handler processes a caller-supplied uid argument. The flaw is CWE-122 (heap-based buffer overflow): the argument is written into a heap-allocated buffer without adequate length validation, letting an attacker supply oversized input that overruns adjacent heap structures, typically corrupting allocator metadata or neighboring objects and potentially redirecting control flow. The CPE cpe:2.3:a:d-link:dir-878:*:*:*:*:*:*:*:* carries a wildcard version, so the CPE itself does not bound the affected range; the reporter (VulDB) attributes the issue specifically to firmware 1.20B05. Because the device family is past end of support, the HNAP stack will not receive hardening or bounds-checking fixes from the vendor, leaving exposure tied entirely to deployment (whether the HNAP/web interface is reachable and from where). The trigger beyond manipulation of the uid argument is not described in the available sources, and reliable code execution is not established by the available PoC reference.
Know when Dir 878 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
HNAP GetCAPTCHAsetting is reachable pre-authentication (PR:N) over the network (AV:N) with no user interaction, and a heap overflow in the CGI yields full code execution, so C/I/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Articles & Coverage 1
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical heap overflow vulnerability in the end-of-life D-Link DIR-878 router (firmware 1.20B05) allows remote attackers to take full control of affected devices, impacting confidentiality, integrity, and availability. Leadership should care because unpatched end-of-life networking gear can serve as a beachhead for lateral movement into the corporate network, though exploitation from the internet requires exposed remote management.
No vendor patch available. Disable WAN-side remote management, restrict HNAP access to trusted LAN segments via firewall rules, isolate devices on a segmented VLAN, and accelerate replacement of end-of-life hardware.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Exploit-DB