A critical memory corruption vulnerability has been disclosed in D-Link’s AC1900-class home router, the DIR-878, and it can be triggered over the network without authentication. The flaw affects firmware version 1.20B05 and is rated critical with a CVSS 3.1 score of 9.8. The researcher who published the code has also shared a GitHub write-up demonstrating exploitability.
The uid field in the HNAP interface overflows
The flaw originates in the device’s HNAP interface. According to the entry opened via VulDB, the bin/prog.cgi file’s GetCAPTCHAsetting function processes the externally supplied uid value without performing bounds checking. When a long value is sent, it causes a heap-based buffer overflow (CWE-122).
The CVSS vector is AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H. In other words, the attack can be carried out over the network, requires no special conditions, does not ask for a username or password, and does not depend on the user clicking a link. On the impact side, confidentiality, integrity, and availability are all marked as high impact. The CVSS 4.0 assessment gives it an 8.9 and classifies exploit maturity as “proof of concept.”
No patch is expected because support has ended
The CVE entry clearly states that the vulnerability affects only products the vendor no longer supports; the record includes no fix or patch information. Since the DIR-878 has long been out of production and off the support list, D-Link is not expected to release new firmware for this model.
The exploit code is available under the title “01-captcha-uid-heap-overflow” in the DIR-878 research on the GitHub account named Zimo-666. A public PoC significantly lowers the knowledge threshold required to use the flaw. The same repository also contains similar research for other D-Link models.
What to do if the device is still in use
The first step is to make sure the router’s management interface is not exposed to the internet. Remote management should be disabled, and there should be no port forwarding or DMZ rule for the management port. If the HNAP feature can be disabled from the interface, turning it off will reduce the attack surface.
The second step is to replace the device. A router whose vendor support has ended carries a permanent risk because the vulnerability cannot be patched; instead of keeping this model directly connected to the internet, replacing it with a supported model is the safest solution. If you cannot retire the device immediately, place it on a separate network segment, allow access to the management interface only from devices you trust, and monitor the router logs for unexpected HNAP requests.
The DIR-878 is one of the older D-Link models with an HNAP interface. This interface is already known to have been the source of similar memory bugs in the past; on unsupported models, new vulnerabilities remaining unpatched makes the risk permanent.
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.