{"cve":"CVE-2014-3936","nvd":{"published":"2014-06-02T14:55:04.263","modified":"2026-06-17T00:09:10.010","status":"Modified","description":"Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-119"],"references":["http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html","http://secunia.com/advisories/58728","http://secunia.com/advisories/58972","http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027","http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029"],"products":["dlink:dir-505l_shareport_mobile_companion","dlink:dir505_shareport_mobile_companion","dlink:dir505_shareport_mobile_companion_firmware","dlink:dir505l_shareport_mobile_companion_firmware","dlink:dsp-w215","dlink:dsp-w215_firmware"],"source":"nvd","synced_at":"2026-10-19T20:33:06.232976534+00:00"},"epss":{"cve":"CVE-2014-3936","score":0.76555,"percentile":0.99542,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}