Field brief
CVE‑2026‑129354: Critical D‑Link DIR‑600L buffer overflow with no vendor fix yet
A critical stack‑based buffer overflow in D‑Link DIR‑600L 2.17b02 has been identified, but no vendor advisory or patch has been released, and it is not yet in the CISA KEV catalog.
A CVE‑2026‑129354 vulnerability was published in the NVD on 15 Nov 2026, describing a stack‑based buffer overflow in the hnap_main function of the D‑Link DIR‑600L 2.17b02 firmware. The CVSS score is 10.0, indicating a critical risk if exploited remotely. No vendor advisory or patch has been issued, and the vulnerability is not listed in the CISA KEV catalog, so no active exploitation has been reported. If you are using a DIR‑600L router, check whether your firmware is 2.17b02 and upgrade to the latest release as soon as it becomes available. Until then, consider disabling the HNAP service or applying any available mitigations to reduce exposure. This issue remains unpatched, so users should monitor vendor announcements and apply the recommended firmware upgrade promptly to mitigate potential exploitation. View NVD record
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.