← Vulnerability feed

Vulnerability record · CVE-2019-17146 · published 7 January 2020

CVE-2019-17146: Dlink dcs-935l firmware stack-based buffer overflow vulnerability

Dlink · Dcs 935l Firmware

This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction request header, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8458.

9.8 CVSS 3.1 Critical EPSS 9.5% · top 4.7% CWE-121 · Stack-based buffer overflowCWE-306 · Missing authentication for critical function
9.8CVSS 3.1 base score, v2 10.0
9.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction request header, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8458.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10142 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-1031/ Third Party AdvisoryVDB Entry
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10142 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-1031/ Third Party AdvisoryVDB Entry

Track CVE-2019-17146 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-48168Dlink dcs-960l firmware code injection vulnerabilityA stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execute arbitra…EPSS 0.96%8.8CVE-2024-44589Dlink dcs-960l firmware stack-based buffer overflow vulnerabilityStack overflow vulnerability in the Login function in the HNAP service in D-Link DCS-960L with firmware 1.09 allows attackers to execute of arbitrary…EPSS 0.89%7.4CVE-2026-13545Dlink dcs-935l firmware command injection vulnerabilityA vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Paramet…EPSS 5.5%7.4CVE-2026-12174Dlink dcs-935l firmware memory buffer overflow vulnerabilityA security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea …EPSS 0.58%7.4CVE-2026-8260Dlink dcs-935l firmware memory buffer overflow vulnerabilityA vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap…EPSS 1.2%7.4CVE-2025-10779Dlink dcs-935l firmware memory buffer overflow vulnerabilityA vulnerability was found in D-Link DCS-935L up to 1.13.01. The impacted element is the function sub_402280 of the file /HNAP1/. The manipulation of …EPSS 0.89%8.8CVE-2026-7273Zyxel gs1900-8 firmware stack-based buffer overflow vulnerabilityA stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-base…KEVEPSS 2.5%8.1CVE-2021-27137DD-WRT UPnP M-SEARCH stack buffer overflowDD-WRT before 45724 contains an unsafe strcpy in the UPnP SSDP handling code (ssdp_msearch), reachable via an M-SEARCH request, that overflows a fixe…KEVEPSS 4.0%analysed

Source: NIST National Vulnerability Database (record CVE-2019-17146), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.