CVE-2017-14948
Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code (remote). The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to mount a ROP attack: if the HTTP header field CONTENT_TYPE starts with ''boundary=' followed by more than 256 characters, a buffer overflow would be triggered, potentially causing code execution.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2019-10-14
- Last modified
- 2024-08-05
- Weaknesses
- CWE-120
Affected products
- Dir-868l Firmware (Dlink)
- Dir-880l Firmware (Dlink)
- Dir-885l Firmware (Dlink)
- Dir-890l Firmware (Dlink)
- Dir-895l Firmware (Dlink)
- Dir-895r Firmware (Dlink)
References
- https://github.com/badnack/d_link_880_bug/blob/master/README.md
