CVE-2021-27114: An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for…

PriorityP265critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

24.55%

97.6th percentile

An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'s_ip" and "s_mac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-816_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/goform/addassignment↗

path/goform/lan

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link lan Multiple Parameters Buffer Overflow Attempt (CVE-2021-27114)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:11; content:"/goform/lan"; fast_pattern; http.request_body; pcre:"/s_(?:mac|ip)\x3d[^&]{100,}(?:&|$)/"; reference:url,github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-816/1.md; reference:cve,2021-27114; classtype:web-application-attack; sid:2065763; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_11_13, cve CVE_2021_27114, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_11_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Look for HTTP POST requests to /goform/lan (URI length exactly 11 bytes) with request body parameters s_mac or s_ip containing 100 or more characters — the PCRE pattern `/s_(?:mac|ip)\x3d[^&]{100,}(?:&|$)/` captures this oversized input indicative of a stack-based buffer overflow attempt.
→The vulnerable endpoint is /goform/addassignment on D-Link DIR-816 A2 1.10 B05; excessively long values in the s_ip and s_mac POST fields overwrite the return address via stack-based buffer overflow. ↗
→Traffic is expected in plaintext (no TLS); deploy detection at the network perimeter and internally targeting destination IP (the D-Link device).

·The Snort/Suricata rule targets /goform/lan (bsize:11) as the URI, while the NVD description references /goform/addassignment as the vulnerable handler. Defenders should monitor both endpoints on D-Link DIR-816 A2 devices.
·The PCRE threshold of 100+ characters for s_mac/s_ip is the detection trigger; legitimate values for IP and MAC fields are far shorter, so false-positive risk is low.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.