CVE-2026-124560

critical

Description

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

References

https://www.dlink.com/

https://vuldb.com/vuln/432892/cti

https://vuldb.com/vuln/432892

https://vuldb.com/submit/1035616

https://vuldb.com/cve/CVE-2026-124560

https://github.com/Zimo-666/DIR-878-cves/tree/main/01-captcha-uid-heap-overflow

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119786

Details

Source: Mitre, NVD

Published: 2026-11-09

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.00721