Any D-Link DIR-878 still in service now carries a critical, remotely exploitable flaw that its maker is not going to patch. The bug, CVE-2026-124560, scores 9.8 on the CVSS 3.1 scale, and it was published on Nov. 9. D-Link stopped supporting the model on Jan. 31, 2021.
Read next on Morning Overview: Arizona’s governor declared a statewide emergency after Flagstaff logged its wettest Nov. 1 on record
The route in is a web-management function that needs no login, so the exposure depends on whether the router’s admin interface faces the internet. Without a vendor fix, D-Link’s own advice points the same way, and the CVE record describes the model as no longer supported.
CVE-2026-124560 in the HNAP handler
TheHackerWire’s write-up describes a heap-based buffer overflow in the HNAP handler of DIR-878 firmware 1.20B05. The flaw lives in the GetCAPTCHAsetting function of bin/prog.cgi, where an oversized or malformed uid argument can write past the allocated buffer. The attack is remote and requires no authentication, and the outcome could be a crash or hijacked control flow.
OpenCVE’s mirror of the record lists a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3, and shows NVD status as deferred with a MITRE publication time of 03:00 UTC on Nov. 9. The same entry states that a public exploit exists, and cites a GitHub proof-of-concept page that is tagged as broken. TheHackerWire’s own page contradicts itself, with one table saying no public proof of concept is indexed, so the exploit status is unsettled. A separate CVE page on the same site repeats the entry. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog as of the Nov. 9 write-up.
D-Link’s end-of-life notice for the DIR-878
D-Link’s own security announcement, SAP10475, is titled for all revisions and all firmware of the DIR-878 as end-of-life and end-of-service. It gives the end-of-support date as Jan. 31, 2021, and states that such products “may no longer receive technical support or firmware updates.” Because no patches are coming, D-Link adds, it may be unable to address device or firmware issues.
The notice, first published on Nov. 17, 2025 and last updated on Sept. 21, 2026, lists six earlier CVEs reported after the end of support, including CVE-2025-60672 and CVE-2025-60673, two unauthenticated remote command execution bugs, and CVE-2026-90692 and CVE-2026-90693, stack overflows in firmware 1.20B05. CVE-2026-124560 does not appear in that list, and the page does not describe any patch for the earlier flaws either.
D-Link’s recommendation is blunt: stop using the device and move to a current-generation product, backing up data before replacing it. It also tells anyone who keeps the router to install the latest firmware from the legacy site and to confirm the hardware revision first.
Stopgaps for a router that cannot be patched
TheHackerWire calls replacement with a supported model the only long-term, secure solution, and offers interim measures. They include disabling remote WAN administration, isolating the device on a dedicated VLAN, and blocking external access to the web interface on ports 80 and 443 with firewall rules. Detection tips include watching server logs for requests to /bin/prog.cgi with unusually long uid values, Syslog entries showing crashes of prog.cgi or the web server are another sign worth checking, the write-up adds.
Those steps shrink the exposure but do not remove the bug, and most home owners lack a managed firewall or VLAN capability. The NVD record for CVE-2026-124560 is the place to watch for a finalized severity score once analysis is completed; the CVSS 4.0 figure already differs between displays, at 9.3 on one and 8.9 in the raw JSON. Replacing the router also resets the support question, since D-Link’s notice points owners to a current-generation product that the vendor still maintains, though it names no specific model.
Exposure is the practical question. TheHackerWire points to a Shodan query for DIR-878 devices that present an HNAP interface, which means the router population reachable from the internet can be enumerated by anyone. That does not say how many remain online, and no source read for this article gives a count. The 9.8 rating reflects the combination of network reach, no authentication and no user interaction, rather than a measured level of attack.
The record also leaves a gap in its own history. The CVE was assigned and published on the same morning, Nov. 9, with NVD deferring its analysis, and the VulDB entry referenced by the record, VDB-432892, came from an outside submission. D-Link itself has not issued a bulletin tied to the new identifier in any source reviewed here, which is the normal pattern for products past their support date: the vendor’s general end-of-life notice stands in for a per-bug advisory.
The open question is whether D-Link will add CVE-2026-124560 to SAP10475. It has done so for six earlier flaws, and the page’s September update date shows it is still being maintained Until then, the bulletin’s list stops at six and the new bug lives only in the CVE databases and in trade-press write-ups, which leaves owners who check D-Link’s site alone with an incomplete picture.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- A handful of car transmissions are so tough that mechanics say they almost never die
- Melting permafrost is setting off a newly identified kind of catastrophic landslide, scientists say
- Cadillac cut the price of its cheapest EV, which goes up to 317 miles on a charge
- Winter weather advisories cover I-80, I-70 and the Bighorns with up to 15 inches of snow
