SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2016-6563

Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers.

CRITICAL 9.8EPSS 79.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 79.9%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L.

CVSS 3.0
9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
79.95% probability · 100th percentile
CISA KEV
Not listed
Weakness
CWE-121, CWE-119
Affected
dlink/dir-823 firmware · dlink/dir-822 firmware · dlink/dir-818l\(w\) firmware · dlink/dir-895l firmware · dlink/dir-890l firmware · dlink/dir-885l firmware · dlink/dir-880l firmware · dlink/dir-868l firmware · dlink/dir-850l firmware
Source
cret@cert.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.