CVE-2016-6563: D-Link DIR routers stack buffer overflow via HNAP SOAP login

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code, and very high EPSS make this an urgent risk for any exposed affected router.

What it is

Malformed SOAP messages sent to the HNAP Login action overflow a stack buffer in several D-Link DIR router models. The vulnerable XML fields are Action, Username, LoginPassword, and Captcha. Because the flaw is remotely reachable without credentials, it exposes affected routers to full compromise.

Impact

An attacker can corrupt stack memory and potentially execute arbitrary code with the router's privileges, gaining control of the device and the network behind it.

Attack surface

Reached over the network through the HNAP SOAP interface; the CVSS vector shows no privileges and no user interaction required, so the request can be sent directly to the router's web service.

Exploitation

Public exploit code exists in Exploit-DB and a Full Disclosure post, and EPSS is 0.797 (99.6th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the vendor firmware update for the affected DIR models; if no fix exists, replace or retire the device.
• Disable remote administration and block HNAP/SOAP access from untrusted networks, restricting it to trusted management hosts.
• Segment router management interfaces from user and guest networks, and place the device behind a firewall that filters inbound access.
• Monitor vendor advisories for these end-of-life models and plan hardware replacement where patching is unavailable.

Detection

• Inspect HTTP requests to the HNAP endpoint for oversized or malformed Action, Username, LoginPassword, or Captcha XML fields.
• Alert on router crashes, reboots, or unexpected process restarts that follow HNAP login traffic.
• Log and review inbound connections to the router's management interface from external or unusual source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.