CVE-2014-3936
published 2014-06-02CVE-2014-3936: Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware…
PriorityP276critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
76.55%
99.5th percentile
Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-505l_shareport_mobile_companion | — | — |
| dlink | dir505_shareport_mobile_companion | — | — |
| dlink | dir505_shareport_mobile_companion_firmware | <= 1.07 | — |
| dlink | dir505l_shareport_mobile_companion_firmware | <= 1.01 | — |
| dlink | dsp-w215 | — | — |
| dlink | dsp-w215_firmware | <= 1.01 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes
|40 5c ac|
bytes
|40 52 34|
bytes
|40 5c 5c|
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M2 (CVE-2014-3936)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1/"; fast_pattern; http.request_body; content:"|40 5c ac|"; reference:cve,2014-3936; classtype:attempted-admin; sid:2062284; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, created_at 2025_05_12, cve CVE_2014_3936, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag AI_Generated_Description, updated_at 2025_05_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M3 (CVE-2014-3936)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1/"; fast_pattern; http.request_body; content:"|40 52 34|"; reference:cve,2014-3936; classtype:attempted-admin; sid:2062285; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, created_at 2025_05_12, cve CVE_2014_3936, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag AI_Generated_Description, updated_at 2025_05_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M1 (CVE-2014-3936)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1/"; fast_pattern; http.request_body; content:"|40 5c 5c|"; reference:cve,2014-3936; classtype:attempted-admin; sid:2062282; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, created_at 2025_05_12, cve CVE_2014_3936, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag AI_Generated_Description, updated_at 2025_05_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Exploit sends an HTTP POST to /HNAP1/ with an oversized Content-Length header in a GetDeviceSettings HNAP action; detect POST requests to /HNAP1/ with anomalously large Content-Length values. ↗
- →Fingerprinting probe is a GET request to /HNAP1/; responses containing 'DIR-505' or 'DSP-W215' with specific firmware version strings indicate a potentially vulnerable device. ↗
- →The Metasploit module uses cmdstager flavor ':echo' with a linemax of 185 bytes for payload staging; look for sequences of short echo commands in post-exploitation traffic. ↗
- ·The DSP-W215 target requires a stack filler offset of 1,000,000 bytes, while DIR-505 targets use 30,000 bytes; IDS/IPS Content-Length thresholds should account for both values to avoid missed detections. ↗
- ·The exploit targets MIPS big-endian (ARCH_MIPSBE) architecture; return addresses and shellcode are MIPS-specific and will not match x86/ARM signatures. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M2 (CVE-2014-3936)
suricata·2025-05-12·CVSS 10.0
CVE-2014-3936 [CRITICAL] ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M2 (CVE-2014-3936)
ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M2 (CVE-2014-3936)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M2 (CVE-2014-3936)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1/"; fast_pattern; http.request_body; content:"|40 5c ac|"; reference:cve,2014-3936; classtype:attempted-admin; sid:2062284; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, created_at 2025_05_12, cve CVE_2014_3936, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag AI_Generated_Description, updated_at 2025_05_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public
Suricata
ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M3 (CVE-2014-3936)
suricata·2025-05-12·CVSS 10.0
CVE-2014-3936 [CRITICAL] ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M3 (CVE-2014-3936)
ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M3 (CVE-2014-3936)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M3 (CVE-2014-3936)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1/"; fast_pattern; http.request_body; content:"|40 52 34|"; reference:cve,2014-3936; classtype:attempted-admin; sid:2062285; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, created_at 2025_05_12, cve CVE_2014_3936, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag AI_Generated_Description, updated_at 2025_05_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public
Suricata
ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M1 (CVE-2014-3936)
suricata·2025-05-12·CVSS 10.0
CVE-2014-3936 [CRITICAL] ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M1 (CVE-2014-3936)
ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M1 (CVE-2014-3936)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link HNAP - Request Remote Buffer Overflow M1 (CVE-2014-3936)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1/"; fast_pattern; http.request_body; content:"|40 5c 5c|"; reference:cve,2014-3936; classtype:attempted-admin; sid:2062282; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, created_at 2025_05_12, cve CVE_2014_3936, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag AI_Generated_Description, updated_at 2025_05_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public
Exploit-DB
D-Link HNAP - Request Remote Buffer Overflow (Metasploit)
exploitdb·2014-07-14
CVE-2014-3936 D-Link HNAP - Request Remote Buffer Overflow (Metasploit)
D-Link HNAP - Request Remote Buffer Overflow (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'D-Link HNAP Request Remote Buffer Overflow',
'Description' => %q{
This module exploits an anonymous remote code execution vulnerability on different
D-Link devices. The vulnerability is due to an stack based buffer overflow while
handling malicious HTTP POST requests addressed to the HNAP handler. This module
has been successfully tested on D-Link DIR-505 in an emulated environment.
},
'Author' =>
[
'Craig Heffner', # vulnerability discovery and initial exploit
'Michael Messner ' # Metasploit module
],
'License' => MSF_LICENSE,
'Platform' => 'linux',
'Ar
Metasploit
D-Link HNAP Request Remote Buffer Overflow
metasploit
D-Link HNAP Request Remote Buffer Overflow
D-Link HNAP Request Remote Buffer Overflow
This module exploits an anonymous remote code execution vulnerability on different D-Link devices. The vulnerability is due to a stack based buffer overflow while handling malicious HTTP POST requests addressed to the HNAP handler. This module has been successfully tested on D-Link DIR-505 in an emulated environment.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.htmlhttp://secunia.com/advisories/58728http://secunia.com/advisories/58972http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plughttp://www.securityfocus.com/bid/67651http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.htmlhttp://secunia.com/advisories/58728http://secunia.com/advisories/58972http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plughttp://www.securityfocus.com/bid/67651
2014-06-02
Published