What’s Vulnerable › Vulnerabilities

CVE-2014-3936

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 76.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-06-02 · updated 2026-06-17
• Weakness: CWE-119

Description

Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.

Affected products

• Dlink Dir-505L Shareport Mobile Companion: a1
• Dlink Dir505 Shareport Mobile Companion: a1
• Dlink Dir505 Shareport Mobile Companion Firmware: through 1.07
• Dlink Dir505L Shareport Mobile Companion Firmware: through 1.01
• Dlink Dsp-W215: a1
• D-Link DSP-W215: through 1.01

References

• http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html
• http://secunia.com/advisories/58728
• http://secunia.com/advisories/58972
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029
• http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug
• http://www.securityfocus.com/bid/67651
• http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html
• http://secunia.com/advisories/58728
• http://secunia.com/advisories/58972
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029

Get alerted when CVE-2014-3936 or the next vulnerability affects your stack