Technical impact
The vulnerability is a stack-based buffer overflow in the hnap_main function of the router's HNAP handler, where a crafted request can overflow the stack and potentially allow an attacker to execute arbitrary code. Based on the description, the flaw can be triggered remotely via a manipulation of the SOAPAction header; the published exploit confirms that remote exploitation is feasible. The stack corruption arises from improper bounds checking of user-supplied input, a classic example of CWE-119 and CWE-121 weaknesses.
Affected Systems
D-Link DIR-600L routers running firmware version 2.17b02 are affected; the vulnerability resides in the htdocs/cgibin component that processes HNAP requests. The flaw is specific to this firmware build and impacts the router’s ability to safely handle SOAP-based commands. In this model, any device that can reach the router’s HTTP interface could potentially abuse the flaw.
Risk and Exploitability
The CVSS score of 10 indicates maximal severity, while the EPSS score is not published; however, the existence of a publicly documented exploit that can be used remotely raises strong concerns about real-world exploitation. The flaw is not yet listed in CISA’s KEV catalog, but the likelihood of exploitation is high due to the remote nature of the attack and the lack of input validation. Prompt remediation is essential, as the attacker can gain full control of the router and compromise the entire local network.
