CVE-2014-125117: d-link dsp-w215 Improper Input Validation

Vulnerability summary

CVE-2014-125117 is a critical (CVSS 9.8) Improper Input Validation vulnerability in d-link dsp-w215. EPSS estimates a 7.93% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 25-07-2025
   PublishedVulnerability first disclosed.
2. 07-04-2026
   Last modifiedVulnerability information updated.

Description

A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthenticated attacker to achieve remote code execution with system-level privileges.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).