« Volver al listado

CVE-2014-3936

Estado: ModificadaAlta (10)—

Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Dlink — Dir-505l Shareport Mobile CompanionDlink — Dir505 Shareport Mobile CompanionDlink — Dir505 Shareport Mobile Companion FirmwareDlink — Dir505l Shareport Mobile Companion FirmwareDlink — Dsp-w215Dlink — Dsp-w215 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3936",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-06-02T14:55:04.263",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/58728",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/58972",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/67651",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/58728",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/58972",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/67651",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de buffer basado en pila en la función do_hnap en www/my_cgi.cgi en D-Link DSP-W215 (Rev. A1) con firmware 1.01b06 y anteriores, DIR-505 con firmware anterior a 1.08b10 y DIR-505L con firmware 1.01 y anteriores permite a atacantes remotos ejecutar código arbitrario a través de una cabecera Content-Length larga en una acción GetDeviceSettings en una solicitud HNAP."
    }
  ],
  "lastModified": "2026-06-17T00:09:10.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir505_shareport_mobile_companion_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C202BCF6-4C77-4B8F-BC86-80706C81BA83",
              "versionEndIncluding": "1.07"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir505_shareport_mobile_companion:a1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC363364-4F6F-49E6-89C4-8DB4885B0394"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir505l_shareport_mobile_companion_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E63A3BCD-C893-4726-90F6-5DF94C595A33",
              "versionEndIncluding": "1.01"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-505l_shareport_mobile_companion:a1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A44598F2-0914-41C7-BA35-BF198F2F4869"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dsp-w215_firmware:*:b06:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C3D2D80-2744-4DAE-B625-89168F130E72",
              "versionEndIncluding": "1.01"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dsp-w215:a1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D58AF41-609E-4FA2-B1B4-15350076D767"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}