CVE-2017-3193

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability in the web administration interface HNAP service.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-119

Affected software

Vendor	Product	Versions
D-Link	DIR-850L and potentially others	1.14B07; 2.07.B05

References

http://www.securityfocus.com/bid/96747Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/viewAlert.x?alertId=52967Patch, Third Party Advisory
https://twitter.com/NCCGroupInfosec/status/845269159277723649Third Party Advisory
https://www.kb.cert.org/vuls/id/305448Third Party Advisory, US Government Resource, VDB Entry
https://www.nccgroup.trust/uk/our-research/d-link-dir-850l-web-admin-interface-vulnerable-to-stack-based-buffer-overflow/?research=Technical+advisoriesThird Party Advisory
http://www.securityfocus.com/bid/96747Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/viewAlert.x?alertId=52967Patch, Third Party Advisory
https://twitter.com/NCCGroupInfosec/status/845269159277723649Third Party Advisory
https://www.kb.cert.org/vuls/id/305448Third Party Advisory, US Government Resource, VDB Entry
https://www.nccgroup.trust/uk/our-research/d-link-dir-850l-web-admin-interface-vulnerable-to-stack-based-buffer-overflow/?research=Technical+advisoriesThird Party Advisory

Timeline

Published: Dec 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-31948.1Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attack CVE-2017-31959.8Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overfl CVE-2017-31967.8PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outs CVE-2017-31979.8GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, B CVE-2017-31989.8GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware upd CVE-2017-31998.1The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than t CVE-2017-32008.1The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their pub CVE-2017-32018.1The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.CVE-2017-32029.8The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary CVE-2017-32038.1The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than CVE-2017-32048.1The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in CVE-2017-32069.8The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (X