CVE-2026-124564 in DIR-878
Summary
by MITRE • 11/09/2026
A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/09/2026
The D-Link DIR-878 router, specifically running firmware version 1.20B05, contains a critical security flaw within its Home Network Administration Protocol handler implementation. The vulnerability resides in the GetListDirectory function located in the bin/prog.cgi script component of the device's web management interface. This specific weakness is classified as CWE-22 Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The core technical issue arises from insufficient validation and sanitization of user-supplied input passed via the ListDirectoryPath argument. When an attacker provides a maliciously crafted string containing relative path sequences such as dot-dot-slash characters, the application fails to properly restrict file access operations to the intended web root directory. Instead, the underlying system interprets these sequences literally, allowing navigation up the filesystem hierarchy beyond the permitted scope.
This architectural failure enables remote attackers who can authenticate or exploit unauthenticated endpoints depending on specific configuration states to read arbitrary files from the router's operating system. By leveraging this path traversal vulnerability, an adversary can access sensitive configuration files that may contain plaintext passwords, cryptographic keys, network topology details, and other proprietary data stored in non-public directories. The presence of a publicly available exploit significantly lowers the barrier for entry, allowing less sophisticated threat actors to execute these attacks against vulnerable devices without requiring custom tool development. This situation aligns with ATT&CK technique T1083 File and Directory Discovery, where adversaries probe the target system to gather information that aids in further lateral movement or data exfiltration.
The operational impact of this vulnerability is severe due to its remote exploitability over network interfaces such as HTTP or HTTPS. Although the HNAP interface typically requires authentication on many devices, misconfigurations or legacy support features may allow unauthenticated access to certain CGI endpoints. Even with authentication required, if credentials are weak or compromised through other vectors, this flaw provides a direct mechanism for escalating privileges and extracting critical system data. The exposure of internal file structures can facilitate subsequent attacks such as credential stuffing against connected devices or the extraction of Wi-Fi keys to compromise local network security. Furthermore, access to configuration files may reveal administrative passwords that allow full control over router settings, including DNS redirections that could lead users to phishing sites.
It is important to note that this vulnerability affects products that are no longer supported by the manufacturer. This lack of ongoing support means that official patches or firmware updates addressing this specific flaw will not be released through standard channels. Consequently, mitigation strategies must rely on compensating controls rather than direct remediation via software updates. Network administrators should consider isolating these legacy devices into a separate VLAN with strict firewall rules to limit their exposure to untrusted networks. If the HNAP interface is not strictly required for daily operations, it should be disabled entirely through available configuration options or by restricting access to trusted IP addresses only. Additionally, changing default administrative credentials and implementing strong password policies can reduce the risk of unauthorized access that precedes exploitation of this path traversal flaw. Organizations relying on such hardware must evaluate the security risks against their threat model and plan for eventual replacement with supported equipment that receives regular security updates.