CVE-2014-3936

Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.

• CWE-119

• http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.htmlExploit
• http://secunia.com/advisories/58728
• http://secunia.com/advisories/58972
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027Vendor Advisory
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029Vendor Advisory
• http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plugExploit
• http://www.securityfocus.com/bid/67651Exploit
• http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.htmlExploit
• http://secunia.com/advisories/58728
• http://secunia.com/advisories/58972
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027Vendor Advisory
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029Vendor Advisory
• http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plugExploit
• http://www.securityfocus.com/bid/67651Exploit

Published

Jun 2, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3930lg.pl in Cistron-LG 1.01 stores sensitive information under …
• CVE-2014-3931fastping.c in MRLG (aka Multi-Router Looking Glass) before 5…9.8
• CVE-2014-3932SQL injection vulnerability in the device registration compo…
• CVE-2014-3933Cross-site scripting (XSS) vulnerability in the address comp…
• CVE-2014-3934SQL injection vulnerability in the Submit_News module for PH…
• CVE-2014-3935SQL injection vulnerability in glossaire-aff.php in the Glos…
• CVE-2014-3937SQL injection vulnerability in the Contextual Related Posts …
• CVE-2014-3938Integer overflow in Autodesk SketchBook Pro before 6.2.6 all…
• CVE-2014-3939Heap-based buffer overflow in Autodesk SketchBook Pro before…
• CVE-2014-3940The Linux kernel through 3.14.5 does not properly consider t…
• CVE-2014-3941TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before…
• CVE-2014-3942The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.…