CVE-2026-124560

validated

GHSA-7474-5gjp-gr7m ↗EUVD-2026-119786 ↗

check availablenot proven exploitable

cve.orgpublic pockev

D-Link DIR-878 1.20B05

CWE-122 Heap-based Buffer Overflow

ETK-2026-3923, permanent identifier

cvss9.3cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

+1h26mTTV

1h 02mAI analysis

Check if you are vulnerable

timeline

0 = trigger signal

trigger signal (cve.org) +0mcheck available+86magent stopped

+30min

+60min

description

D-Link DIR-878 devices running firmware 1.20B05 are affected by a heap-based buffer overflow in HNAP request handling. A remote unauthenticated attacker who can reach the HNAP interface may cause memory corruption that could compromise the device.

mitigation

Remove affected routers from internet-facing and untrusted networks, and restrict administrative-service access to trusted management networks. Replace affected DIR-878 devices with supported hardware, as no fixed version is recorded and the model is end of support.

check

available

exploit

automation

deterministic

auth required

EPSS

0.72%54th percentile

agent run time

1h 02m

cve.org record, t = 0

2026-11-09 03:00Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-09 03:00Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-124560

this entry in the feed

GET /api/v1/feed/CVE-2026-124560

{
  "etk_id": "ETK-2026-3923",
  "cve_id": "CVE-2026-124560",
  "display_id": "CVE-2026-124560",
  "ghsa_id": "GHSA-7474-5gjp-gr7m",
  "euvd_id": "EUVD-2026-119786",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Heap-based buffer overflow in D-Link DIR-878 HNAP handler",
  "summary": "D-Link DIR-878 devices running firmware 1.20B05 are affected by a heap-based buffer overflow in HNAP request handling. A remote unauthenticated attacker who can reach the HNAP interface may cause memory corruption that could compromise the device.",
  "mitigation": "Remove affected routers from internet-facing and untrusted networks, and restrict administrative-service access to trusted management networks. Replace affected DIR-878 devices with supported hardware, as no fixed version is recorded and the model is end of support.",
  "vendor": "D-Link",
  "product": "DIR-878",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.20B05"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "DIR-878",
      "purl": null
    }
  ],
  "cwes": [
    122
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
  "epss_score": 0.0072,
  "epss_percentile": 0.5423,
  "epss_asof": "2026-11-09",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 61.88681865,
  "t0_at": "2026-11-09T03:00:30.223000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-09T04:26:59.482769+00:00",
      "days": 0.06006087695601852,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T03:00:30.223000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-09T03:00:30.223000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T03:00:30.223000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-124560"
    }
  }
}

published 2026-11-09 03:25Z
last change 2026-11-11 04:39Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.