VDB

CVE-2016-6563

CVE-2016-6563 PUBLISHED CVSS 9.800000190734863 CRITICAL

Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L.

EPSS 84.89% · 99.4th percentile

Risk Scores

CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
84.89%
99.4th percentile

Affected Products

VendorProductVersions
dlinkdir-818l\(w\)_firmware
D-LinkDIR-822N/A
dlinkdir-868l_firmware
D-LinkDIR-823N/A
D-LinkDIR-818L(W)N/A
dlinkdir-890l_firmware
dlinkdir-822_firmware
D-LinkDIR-890L*
dlinkdir-885l_firmware
dlinkdir-895l_firmware
dlinkdir-850l_firmware
dlinkdir-880l_firmware
D-LinkDIR-850L*
D-LinkDIR-895L*
D-LinkDIR-885LN/A
D-LinkDIR-880LN/A
dlinkdir-823_firmware
D-LinkDIR-868LN/A

Timeline

  • Apr 13, 2015 PoC Published
  • Nov 7, 2016 CVE Published
  • Nov 9, 2016 PoC Published
  • Nov 21, 2016 PoC Published
  • Nov 23, 2016 PoC Published
  • May 29, 2018 PoC Published
  • Feb 4, 2022 EPSS Score
  • Mar 29, 2022 EPSS Score
  • Jul 12, 2022 EPSS Score
  • Sep 3, 2022 EPSS Score
  • Oct 26, 2022 EPSS Score
  • Feb 8, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›