NetSight
IP …
critical10.0Public exploit code

CVE-2014-3936

Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.

Affected products

VendorProductAffected versions
DlinkDir505 Shareport Mobile Companion Firmware
through 1.07
DlinkDir505 Shareport Mobile Companion
Version a1
DlinkDir505l Shareport Mobile Companion Firmware
through 1.01
DlinkDir-505l Shareport Mobile Companion
Version a1
DlinkDsp-W215 Firmware
through 1.01
DlinkDsp-W215
Version a1

Weakness classification

CWE-119

References