Five remote vulnerabilities have been disclosed in the D-Link DIR-878 home router, all published as CVE records on 9 November 2026. The flaws carry the identifiers CVE-2026-124560 through CVE-2026-124564, and public exploit code exists for them. The router is no longer supported by D-Link, so no patch is coming.

All five flaws sit in the router's HNAP handler, the component that answers home-network administration requests, in firmware version 1.20B05. The CVE records describe the attacks as remotely initiated, and no login is required to trigger them where the management interface can be reached.

The five flaws

The most serious is CVE-2026-124560, a heap-based buffer overflow in the GetCAPTCHAsetting function of prog.cgi, triggered by manipulating the uid argument. It carries a CVSS score of 9.8, rated critical, and can allow remote code execution.

CVE-2026-124561 is a stack-based buffer overflow in SetVLANSettings, triggered through the VID argument. CVE-2026-124562 and CVE-2026-124563 are both buffer overflows in SetWanSettings, one through the ConfigDNS arguments and the other through the Primary and Secondary arguments. All three are rated high severity, with CVSS scores of 7.5.

CVE-2026-124564 is a path traversal flaw in GetListDirectory, triggered through the ListDirectoryPath argument, which can allow access to files outside the intended directory. The CVE records note that the vulnerabilities affect only products that are no longer supported by the maintainer.

No patch is coming

D-Link ended support for the DIR-878 years ago. The CVE records state plainly that the flaws affect products no longer supported by the maintainer, and the public write-ups of the batch give the same remediation advice in full: isolate or decommission the affected routers.

There is no sign yet that the flaws are being exploited in the wild. They do not appear in CISA's Known Exploited Vulnerabilities catalog, and analysts tracking the batch reported on 9 November that they had seen no exploit traffic against these five CVEs so far. That is a snapshot, not a guarantee: with working exploit code public, scanning for the flaws is expected.

Why old routers stay dangerous

End of life is a support status, not a physical one. A retired router keeps answering requests exactly as it did when it was new, and many remain in service in homes and small offices, sometimes providing the internet connection for a home worker whose machine also reaches a company network.

Routers are a favoured target for botnet operators because they are always on, rarely monitored, and often reachable from the internet. A remotely exploitable flaw in a device with no patch is, for practical purposes, a permanent hole.

What owners should do

Anyone still running a DIR-878 should check the model and firmware version, take the management interface off the internet if it is exposed, and plan to replace the device. If replacement is not immediate, the router should sit behind a firewall with remote administration disabled and only trusted local devices allowed to reach it.

Owners should also check whether any other D-Link hardware on their network is past support, since the same pattern — old firmware, public exploits, no fix — applies across the retired range. The five CVE records are published on the CVE programme's site, and the NinjaLabz daily briefing of 9 November summarises the batch.