CVE-2026-124564mediumCWE-22

CVE-2026-124564: fallo de gravedad media en D-Link DIR-878

D-Link DIR-878 HNAP prog.cgi GetListDirectory path traversal

Publicada el

Seguir esta CVE+ Monitorear DIR-878

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

10Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9
A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
D-Link · DIR-878
CVEs relacionadas — D-Link DIR-878

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-0717MEDIUMD-Link Good Line Router v2 HTTP GET Request devinfo information disclosureEPSS 18.2%CVE-2022-26670HIGHD-Link DIR-878 - Command InjectionEPSS 1.5%CVE-2025-0481MEDIUMD-Link DIR-878 HTTP POST Request dllog.cgi information disclosureEPSS 1.4%CVE-2026-90693CRITICALD-Link DIR-878 WAN Settings SetWan3Settings stack-based overflowEPSS 0.9%CVE-2026-90692CRITICALD-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflowEPSS 0.9%CVE-2026-124563HIGHD-Link DIR-878 HNAP SetWanSettings buffer overflowEPSS —