Overview
CVE-2026-124560 is a critical vulnerability (CVSS 9.8) in the D-Link DIR-878 router, firmware 1.20B05. The flaw sits in the GetCAPTCHAsetting function of bin/prog.cgi, part of the HNAP handler. Manipulating the uid argument causes a heap-based buffer overflow.
NVD notes the attack can be launched remotely and that an exploit has been made public, which raises the practical risk for any exposed device.
Technical Details
| Item | Detail |
|---|---|
| Component | HNAP Handler (bin/prog.cgi) |
| Function | GetCAPTCHAsetting |
| Vulnerable argument | uid |
| Weakness | Heap-based buffer overflow |
| Attack vector | Network (remote) |
| CVSS | 9.8 (Critical) |
HNAP (Home Network Administration Protocol) is a SOAP-based management interface that consumer routers expose over HTTP. A memory corruption bug in a request handler reachable over the network typically leads to a crash at minimum and, with a reliable exploit, code execution on the device.
Impact
- Remote denial of service of the router
- Potential arbitrary code execution on the device
- Router takeover enables traffic interception, DNS tampering, and use as a botnet node
Consumer and small-office routers from this class have repeatedly been recruited into botnets after public exploits appeared.
Recommended Actions
- Check D-Link's support site for a firmware update for the DIR-878 and apply it when available.
- Make sure remote (WAN-side) administration is disabled.
- Restrict access to the management interface to trusted LAN hosts.
- If the model is end-of-life with no patch, plan to replace it.
- Monitor for unexpected router reboots, configuration changes, or unusual outbound traffic.