CVE-2026-124560 is a critical, remotely triggerable heap-based buffer overflow in the HNAP Handler of D-Link DIR-878 firmware 1.20B05, affecting a product its maintainer no longer supports.
What Is It
The flaw is in the GetCAPTCHAsetting function of bin/prog.cgi, which belongs to the router's HNAP Handler component. Manipulating the uid argument causes a heap-based buffer overflow (CWE-122, also classified as CWE-119). VulDB, the CNA, published the record on 2026-11-09. NVD lists its status as "Deferred."
Why It Matters
- CVSS 3.1: 9.8 (Critical), vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. An attacker can trigger it over the network with low complexity, no privileges and no user interaction, with high impact to confidentiality, integrity and availability. - CVSS 4.0: 8.9 (High), with exploit maturity rated Proof-of-Concept.
- CVSS 2.0: 10.0.
- The NVD description says "the exploit has been made public and could be used." A public write-up is linked from the record.
- This CVE is not in CISA's Known Exploited Vulnerabilities catalog. The supplied KEV entry is empty, so KEV does not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: D-Link
- Product: DIR-878
- Affected version: 1.20B05
- Component: HNAP Handler (
bin/prog.cgi, functionGetCAPTCHAsetting) - CPE:
cpe:2.3:h:d-link:dir-878:*:*:*:*:*:*:*:*
The CNA tagged the record unsupported-when-assigned. That means the product was already out of support when the CVE was assigned.
Patch Status
The source data references no patch or vendor fix. The NVD record says this vulnerability "only affects products that are no longer supported by the maintainer," so a vendor update should not be expected. There is no KEV entry, which means CISA has issued no required action or due date. Owners of DIR-878 units running 1.20B05 should treat the device as having a critical, unauthenticated flaw with public exploit details and no supported fix, and decide whether to keep running it on that basis.