D-Link DIR-878 HNAP Handler Buffer and Path Flaws

A heap-based buffer overflow in the HNAP handler of D-Link DIR-878 firmware 1.20B05 allows remote attackers to corrupt heap memory by manipulating the uid argument passed to the GetCAPTCHAsetting function in bin/prog.cgi, with potential for full confidentiality, integrity and availability impact on the device (CVSS 3.1 9.8-equivalent metrics of AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). Per the assessed vector, no authentication or user interaction is required, although practical exploitation depends on the attacker being able to reach the HNAP management interface - normally LAN-side unless remote management is exposed toward the WAN. The DIR-878 is end-of-life and no longer maintained, so no vendor patch is expected; a public PoC reference exists in a GitHub repository, but it is not verified as working exploit code, and the current priority decision is monitor with no confirmed active exploitation (no CISA KEV listing).

Stack-based buffer overflow in the HNAP SetWanSettings handler of D-Link DIR-878 firmware 1.20B05 allows remote attackers to crash or otherwise disrupt the device by supplying overlong ConfigDNS/Primary or ConfigDNS/Secondary values. The CVSS vector indicates no authentication or user interaction and low attack complexity, but the scored impact is availability only, with no confidentiality or integrity effect. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV confirmation is available. The DIR-878 is end-of-life, so exposure is limited to units still in service.

A stack-based buffer overflow in the HNAP handler of D-Link DIR-878 firmware 1.20B05 allows remote, unauthenticated attackers to crash or destabilize the device by sending a crafted SetVLANSettings request to prog.cgi with a manipulated VID argument. The assessed impact is availability only (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/A:H), meaning a successful request can take the router's management service down rather than expose data or permit code execution, which the available assessment does not establish. A public PoC reference exists in a GitHub repository, but it is not verified as working exploit code; there is no CISA KEV entry and the priority is moderate (this_week) rather than emergency. Because the DIR-878 is end-of-life and no longer maintained by D-Link, no vendor fix is expected, so exposure reduction or hardware replacement is the practical path.

A buffer overflow in the HNAP handler of D-Link DIR-878 firmware 1.20B05 allows remote attackers to crash the device by sending a crafted SetWanSettings request with an oversized Primary or Secondary (DNS) argument; the assessed impact is availability-only (C:N/I:N/A:H) and the CVSS vector requires no authentication (PR:N) and no user interaction (UI:N). The DIR-878 1.20B05 is end-of-life with no vendor patch, so exposure is confined to owners of this specific unsupported model, and although the vector is marked AV:N, HNAP is typically a LAN-side service, so exploitation across the internet realistically depends on WAN-side remote management being enabled. A public PoC reference exists; it is not verified as working exploit code, and the issue is not listed in CISA KEV.

Path traversal in the HNAP handler of D-Link DIR-878 firmware 1.20B05 allows remote attackers to read files outside the intended directory by supplying crafted ListDirectoryPath input to GetListDirectory in bin/prog.cgi. The advisory states publicly available exploit code exists, but active exploitation is not confirmed by the supplied data, and impact is limited to low confidentiality disclosure. The product is end-of-life, and no vendor-released patch was identified at time of analysis.