CVE-2016-6563 D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action
CriticalCVSS 9.8
EPSS 79.7%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dlink dir-823 firmware | All versions | No fix listed |
| dlink dir-822 firmware | All versions | No fix listed |
| dlink dir-818lw firmware | All versions | No fix listed |
| dlink dir-895l firmware | All versions | No fix listed |
| dlink dir-890l firmware | All versions | No fix listed |
| dlink dir-885l firmware | All versions | No fix listed |
| dlink dir-880l firmware | All versions | No fix listed |
| dlink dir-868l firmware | All versions | No fix listed |
| dlink dir-850l firmware | All versions | No fix listed |
| d-link DIR-823 | All versions | No fix listed |
| d-link DIR-822 | All versions | No fix listed |
| d-link DIR-818LW | All versions | No fix listed |
| d-link dir-895l | All versions | No fix listed |
| d-link DIR-890L | All versions | No fix listed |
| d-link DIR-885L | All versions | No fix listed |
| d-link dir-880l | All versions | No fix listed |
| d-link dir-868l | All versions | No fix listed |
| d-link DIR-850L | All versions | No fix listed |
References
- 20161107 [CVE-2016-6563 / VU#677427]: Dlink DIR routers HNAP Login stack buffer overflow exploit mailing-list third-party-advisory
- 94130 third-party-advisory vdb-entry
- 40805 exploit third-party-advisory vdb-entry
- VU#677427 third-party-advisory us-government-resource