D-Link DIR-878 (1.20B05) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/d-link-dir-878-1.20b05/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 06:19:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgD-Link DIR-878: Heap-based buffer overflow in HNAP handler (CVE-2026-124560)https://feed.craftedsignal.io/briefs/2026-11-dlink-dir-878-overflow/Mon, 09 Nov 2026 06:19:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-dlink-dir-878-overflow/A public proof-of-concept exploit is available for a remote heap-based buffer overflow in the D-Link DIR-878 HNAP handler.A vulnerability exists in the D-Link DIR-878 (version 1.20B05) within the GetCAPTCHAsetting function of the bin/prog.cgi file in the HNAP Handler component. Manipulating the uid argument results in a heap-based buffer overflow. The attack can be initiated remotely. The vulnerability affects products no longer supported by the maintainer, and a public proof-of-concept exploit is available.

]]>highadvisory