Dlink Dsp-W215 Firmware vulnerabilities

5 known vulnerabilities affecting dlink/dsp-w215_firmware.

Total CVEs

5

CISA KEV

0

Public exploits

1

Exploited in wild

0

Severity breakdown

CRITICAL2HIGH2MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2014-125117CRITICALCVSS 9.3v1.022025-07-25

CVE-2014-125117 [CRITICAL] CWE-20 CVE-2014-125117: A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, i A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthenticated attacker to achieve remote code execution with system-level privileges.

CVE-2021-29295HIGHCVSS 7.5v1.102021-08-10

CVE-2021-29295 [HIGH] CWE-476 CVE-2021-29295: Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote mali Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via usr/bin/lighttpd. It could be triggered by sending an HTTP request without URL in the start line directly to the device. NOTE: The DSP-W215 and all hardware revisions is considered End of Life and as such this iss

CVE-2020-13136HIGHCVSS 7.5v1.26b032020-05-18

CVE-2020-13136 [HIGH] CVE-2020-13136: D-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a ne D-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a network sniffer.

CVE-2020-13135MEDIUMCVSS 6.5v1.26b032020-05-18

CVE-2020-13135 [MEDIUM] CWE-327 CVE-2020-13135: D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local n D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy.

CVE-2014-3936CRITICALCVSS 10.0PoC≤ 1.012014-06-02

CVE-2014-3936 [CRITICAL] CWE-119 CVE-2014-3936: Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) w Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.