Executive brief
D-Link DIR-823G is a wireless router used in home and small office networks. A remote attacker can send specially crafted XML requests to the router's web management interface that overflow internal memory buffers, causing the web service to crash and potentially enabling arbitrary code execution on the device.
Technical details
The vulnerability is a stack-based buffer overflow (CWE-121) in the HNAP1 SetStaticRouteSettings handler. The vulnerable component uses unbounded strcpy() calls to copy XML field values (IPAddress, SubnetMask, Gateway) into fixed 32-byte stack buffers without length validation. An attacker can send oversized values in these XML fields via an HTTP POST request to /HNAP1/SetStaticRouteSettings to trigger memory corruption. No authentication is required; the attack is remotely exploitable from the network. Successful exploitation causes crashes of the web management process and potentially allows code execution. A patch is not yet known to be available.
Affected products
- D-Link DIR-823G 1.0.2B05_20181207
Timeline
- 2026-09-14: disclosed