Description

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway results in stack-based buffer overflow. The attack can be launched remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-14T04:16:36.353Z",
  "pubdate": "2026-09-14T04:16:36.353Z",
  "executiveSummary": "A critical security vulnerability has been identified in the HNAP1 component of the D-Link DIR-823G router, specifically within the /HNAP1/SetStaticRouteSettings function.\nThe vulnerability is classified as a stack-based buffer overflow, resulting from the insecure use of the strcpy function when processing user-supplied input.\nThe flaw allows a remote, unauthenticated attacker to inject malicious data into the stack, potentially leading to arbitrary code execution or a denial-of-service state.\nImpacted systems include D-Link DIR-823G running firmware version 1.0.2B05_20181207.\nSuccessful exploitation compromises the integrity and availability of the networking device, granting the attacker control over the execution flow of the affected process.\nGiven the nature of the HNAP1 interface, this vulnerability poses a severe risk as it is accessible over the network without requiring prior authentication, facilitating widespread exposure.",
  "technicalDetails": "The vulnerability resides in the /HNAP1/SetStaticRouteSettings function, which is responsible for processing static route configurations via the Home Network Administration Protocol (HNAP1).\nThe root cause is a classic stack-based buffer overflow stemming from the use of the unsafe strcpy function. This function copies input from the PAddress, SubnetMask, or Gateway arguments into a fixed-length buffer on the stack without performing necessary bounds checking.\nBecause the input length is not validated before the memory copy operation, an attacker can supply an arbitrarily long string that exceeds the designated buffer size. This allows the attacker to overwrite adjacent memory, including the saved return address on the stack frame.\nThe exploitation flow begins with the attacker crafting a malicious HNAP1 request targeting the /HNAP1/SetStaticRouteSettings endpoint. The attacker includes a specially crafted payload within the PAddress, SubnetMask, or Gateway XML tags. This payload is structured to contain sufficient data to overflow the stack buffer, followed by a malicious instruction sequence or return address redirection.\nUpon receiving the request, the application passes the user-provided data directly to strcpy. The resulting buffer overflow overwrites the return pointer of the current function. When the function attempts to return, the instruction pointer is redirected to the attacker-supplied address.\nIn a typical exploit scenario, the attacker might chain this redirection to point to a NOP sled or shellcode injected into the stack, thereby executing arbitrary code with the privileges of the HNAP1 process. Alternatively, the attacker may overwrite adjacent functional variables to bypass security checks or trigger a segmentation fault, leading to a crash and denial-of-service for the routing functionality.\nThe vulnerability is highly exploitable remotely as it resides in a management interface (HNAP1) that is frequently exposed to the WAN or LAN, and it does not require the attacker to possess prior authentication credentials to trigger the vulnerable code path."
}