CVE-2026-129354 is a critical stack-based buffer overflow in the HNAP Handler of D-Link DIR-600L firmware 2.17b02, and a public exploit is available.
What Is It
CVE-2026-129354 is a stack-based buffer overflow (CWE-121, CWE-119) in the hnap_main function of htdocs/cgibin, part of the device's HNAP Handler component. According to the CNA description, manipulating input to this function can overflow a buffer on the stack. The attack can be launched remotely. One of the referenced advisories is titled "D-Link-DIR-600L-HNAP-SOAPAction", which suggests the HNAP SOAPAction handling is the affected input path.
VulDB, acting as the CNA, published the CVE. NVD lists its status as Deferred.
Why It Matters
The CVSS scores leave little room for doubt about severity:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
An attacker can reach the flaw over the network with low complexity. They need no privileges and no user interaction. Confidentiality, integrity and availability impact are all rated high, and the scope is "changed", so the impact can reach beyond the vulnerable component. The CNA states that "the exploit has been published and may be used."
KEV status: CVE-2026-129354 is not listed in the CISA Known Exploited Vulnerabilities Catalog. That means CISA has not confirmed active exploitation in the wild as of this writing. Even so, a public exploit exists, and the CVSS vector rates the flaw as exploitable without authentication. Treat any DIR-600L running firmware 2.17b02 with an HNAP interface an attacker can reach as high priority. For other firmware versions, exposure is unconfirmed.
What's Vulnerable
- Vendor: D-Link
- Product: DIR-600L
- Affected version: 2.17b02
- Component: HNAP Handler (
hnap_main,htdocs/cgibin) - CPE:
cpe:2.3:h:d-link:dir-600l:*:*:*:*:*:*:*:*
The supplied records name only firmware 2.17b02 as affected. They do not say whether other versions are affected.
Patch Status
The KEV and NVD records do not identify a patch, fixed firmware version or vendor advisory. CISA has not issued a required action, because there is no KEV entry. Owners of DIR-600L devices should:
- Check D-Link's site for firmware updates or advisories about this device.
- Keep the router's management and HNAP interfaces off untrusted networks.
- Consider replacing the device if D-Link releases no fix.