CRITICAL
D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE
Published Jul 25, 2025
9.3
CRITICALCVSS 4.0
EPSS 7.22%
Description
A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthenticated attacker to achieve remote code execution with system-level privileges.
Affected products
-
- Version 1.02StatusaffectedConstraints-
- Version
AND
- 1.02
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (6)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-9810 Advisory
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb exploit
- https://web.archive.org/web/20140525215526/http://www.devttys0.com/2014/05/hacking-the-dspw215-again/ technical-descriptionexploitThird Party Advisory
- https://www.exploit-db.com/exploits/34063 exploit
- https://www.fortiguard.com/encyclopedia/ips/38932/d-link-info-cgi-post-request-buffer-overflow third-party-advisoryThird Party Advisory
- https://www.vulncheck.com/advisories/dlink-stack-based-buffer-overflow-rce third-party-advisoryThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-9810 | Advisory | |
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb | exploit | |
| https://web.archive.org/web/20140525215526/http://www.devttys0.com/2014/05/hacking-the-dspw215-again/ | technical-descriptionexploitThird Party Advisory | |
| https://www.exploit-db.com/exploits/34063 | exploit | |
| https://www.fortiguard.com/encyclopedia/ips/38932/d-link-info-cgi-post-request-buffer-overflow | third-party-advisoryThird Party Advisory | |
| https://www.vulncheck.com/advisories/dlink-stack-based-buffer-overflow-rce | third-party-advisoryThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Jul 25, 2025
Updated Apr 7, 2026
Reserved Jul 24, 2025
Link CVE-2014-125117
CISA Vulnrichment
Updated Jul 29, 2025
ENISA EUVD
EUVD-2014-9810 Assigner VulnCheck
Published Jul 25, 2025
Updated Apr 7, 2026
Exploited since n/a
Link EUVD-2014-9810