Description
Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
D-Link HNAP Request Remote Buffer Overflow
exploit/linux/http/dlink_hnap_bof
Exploit-DB 1
- D-Link HNAP - Request Remote Buffer Overflow (Metasploit) EDB-34064 · remote · Jul 14, 2014 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027
- http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug
- 58728 third-party-advisory
- http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html
- 58972 third-party-advisory
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029
- 67651 vdb-entry