PT-2025-38678 · D Link · Dcs-935L
Lexpl0It
·
Published
2025-09-13
·
Updated
2025-09-27
·
CVE-2025-10779
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
D-Link DCS-935L versions prior to 1.13.01
Description
A stack-based buffer overflow issue exists in the
sub 402280 function of the /HNAP1/ file. The issue is due to the manipulation of the HNAP AUTH/SOAPAction argument, which can allow a remote attacker to execute arbitrary code. The vulnerability is related to a flawed implementation of the strcpy() function, which copies data into a buffer without checking the size of the input. This allows an attacker to send a specially crafted POST request to trigger the overflow. The product is no longer supported by the maintainer.Recommendations
Versions prior to 1.13.01 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Corruption
Stack Overflow
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Dcs-935L