CVE-2014-7859 Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build 03, and DNS-327L before 1.04b01 allows r...
CriticalCVSS 9.8
EPSS 20.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build 03, and DNS-327L before 1.04b01 allows remote attackers to execute arbitrary code by crafting malformed "Host" and "Referer" header values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| d-link dns-322l firmware | <= 2.00b07 | No fix listed |
| d-link dns-320lw firmware | <= 1.03b04 | No fix listed |
| d-link dnr-326 firmware | <= 1.40b03 | No fix listed |
| d-link dns-327l firmware | <= 1.02 | No fix listed |
| d-link dnr-320l firmware | <= 1.03b04 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20150531 [SEARCH-LAB advisory] More than fifty vulnerabilities in D-Link NAS and NVR devices mailing-list third-party-advisory vdb-entry
- www.search-lab.hu technical-description third-party-advisory
- 20150528 [SEARCH-LAB advisory] More than fifty vulnerabilities in D-Link NAS and NVR devices mailing-list third-party-advisory vdb-entry
- 74878 third-party-advisory vdb-entry