Unauthenticated command execution via unchecked SID length
Published Aug 19, 2024 · Updated Mar 17, 2025
Stack-based buffer overflow in D-Link DIR-860L firmware 2.03 allows remote attackers to crash the router or execute commands. The genacgi_main path in /htdocs/cgibin passes the attacker-controlled HTTP SID header to sprintf without checking its length, overflowing a stack buffer during an UNSUBSCRIBE request to /gena.cgi. The UPnP service accepts the request on TCP port 49152 without authentication; exploitation can interrupt routing or run commands with the CGI process's privileges.
Summary
What happened
Stack-based buffer overflow in D-Link DIR-860L firmware 2.03 allows remote attackers to crash the router or execute commands. The genacgi_main path in /htdocs/cgibin passes the attacker-controlled HTTP SID header to sprintf without checking its length, overflowing a stack buffer during an UNSUBSCRIBE request to /gena.cgi. The UPnP service accepts the request on TCP port 49152 without authentication; exploitation can interrupt routing or run commands with the CGI process's privileges.
The record
- CVE
- CVE-2024-42812
- Published
- Aug 19, 2024
- Updated
- Mar 17, 2025
- Vendor
- D-Link
- Product
- DIR-860L
- Classifications
- CWE-120, T1190
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Aug 19, 2024CVE publishedPublication date reported by the CVE source.
- Mar 17, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=v2.03
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- CVE D-Link Report proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo