PT-2014-5616 · D Link · D-Link Dir-505+1

Published 2014-06-02 · Updated 2023-04-26 · CVE-2014-3936

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DSP-W215 versions 1.01b06 and earlier D-Link DIR-505 versions prior to 1.08b10 D-Link DIR-505L versions 1.01 and earlier

Description The issue allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request. This is due to a stack-based buffer overflow in the do hnap function in www/my cgi.cgi.

Recommendations For D-Link DSP-W215 versions 1.01b06 and earlier, update to a version later than 1.01b06. For D-Link DIR-505 versions prior to 1.08b10, update to version 1.08b10 or later. For D-Link DIR-505L versions 1.01 and earlier, update to a version later than 1.01.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-3936

Affected Products

D-Link Dir-505

D-Link Dsp-W215

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_hnap_bof.rb · Exploit
• 🔥 http://securityfocus.com/bid/67651 · Exploit
• 🔥 http://devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug · Exploit
• 🔥 http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html · Exploit
• 🔥 https://exploit-db.com/exploits/34064 · Exploit
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3936 · Security Note
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029 · Vendor Advisory
• http://secunia.com/advisories/58728 · Note
• http://secunia.com/advisories/58972 · Note