CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2016-6563
Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L.
Severity
- EPSS
- 80% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-119, CWE-121
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dlink:dir-818l\(w\)_firmware
- dlink:dir-822_firmware
- dlink:dir-823_firmware
- dlink:dir-850l_firmware
- dlink:dir-868l_firmware
- dlink:dir-880l_firmware
- dlink:dir-885l_firmware
- dlink:dir-890l_firmware
- dlink:dir-895l_firmware