CVE-2014-125117

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-125117
A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthenticated attacker to achieve remote code execution with system-level privileges.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb Exploit
https://web.archive.org/web/20140525215526/http://www.devttys0.com/2014/05/hacking-the-dspw215-again/ Exploit Third Party Advisory
https://www.exploit-db.com/exploits/34063 Exploit
https://www.fortiguard.com/encyclopedia/ips/38932/d-link-info-cgi-post-request-buffer-overflow Third Party Advisory
https://www.vulncheck.com/advisories/dlink-stack-based-buffer-overflow-rce Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dsp-w215_firmware:1.02:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsp-w215:-:*:*:*:*:*:*:*
History

23 Sep 2025, 18:03

Type Values Removed Values Added
CPE cpe:2.3:o:dlink:dsp-w215_firmware:1.02:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dsp-w215:-:*:*:*:*:*:*:*
References () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb - () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb - Exploit
References () https://web.archive.org/web/20140525215526/http://www.devttys0.com/2014/05/hacking-the-dspw215-again/ - () https://web.archive.org/web/20140525215526/http://www.devttys0.com/2014/05/hacking-the-dspw215-again/ - Exploit, Third Party Advisory
References () https://www.exploit-db.com/exploits/34063 - () https://www.exploit-db.com/exploits/34063 - Exploit
References () https://www.fortiguard.com/encyclopedia/ips/38932/d-link-info-cgi-post-request-buffer-overflow - () https://www.fortiguard.com/encyclopedia/ips/38932/d-link-info-cgi-post-request-buffer-overflow - Third Party Advisory
References () https://www.vulncheck.com/advisories/dlink-stack-based-buffer-overflow-rce - () https://www.vulncheck.com/advisories/dlink-stack-based-buffer-overflow-rce - Third Party Advisory
First Time Dlink dsp-w215 Firmware
Dlink
Dlink dsp-w215
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

29 Jul 2025, 14:14

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de desbordamiento de búfer basada en pila en el componente my_cgi.cgi de ciertos dispositivos D-Link, incluido el DSP-W215 versión 1.02, puede explotarse mediante una solicitud HTTP POST especialmente manipulada al endpoint /common/info.cgi. Esta falla permite a un atacante no autentica Ddo ejecutar código remoto con privilegios de sistema.

25 Jul 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 16:15

Updated : 2025-09-23 18:03

NVD link : CVE-2014-125117

Mitre link : CVE-2014-125117

CVE.ORG link : CVE-2014-125117

JSON object : View

Products Affected

dlink

  • dsp-w215_firmware
  • dsp-w215
CWE
CWE-20

Improper Input Validation

CWE-121

Stack-based Buffer Overflow