9.8crit
CVE-2016-1558
Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver.
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
9.1%
percentile 95%
Public exploits
0
none known
Summary
Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. B1 3.05 and earlier, DAP-2660 1.11 and earlier, DAP-2690 3.15 and earlier, DAP-2695 1.16 and earlier, DAP-3320 1.00 and earlier, and DAP-3662 1.01 and earlier allows remote attackers to have unspecified impact via a crafted 'dlink_uid' cookie.
Exploit prediction (EPSS)
9.10% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- dlink.com /mk/mk/support/support-news/2016/march/16/firmadyne-cve_2016_1558-cve_2016_1559 · x_refsource_CONFIRM, x_transferred
- packetstormsecurity.com /files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html · x_refsource_MISC, x_transferred
- seclists.org /fulldisclosure/2016/Feb/112 · mailing-list, x_refsource_FULLDISC, x_transferred
Sources
- CVE List: CVE-2016-1558
- NVD: CVE-2016-1558
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.