A vulnerability has been found in D-Link DIR-816L 2_06_b09_beta. This affects the function genacgi_main of the file gena.cgi. The manipulation of the argument SERVER_ID/HTTP_SID leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.4 · dlinkNVD modified 2026-10-18 20:10
Affected (CPE criteria) 1
cpe:2.3:o:dlink:dir-816l_firmware:2.06.b09:beta:*:*:*:*:*:*
References 6
- https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(gena.cgi).pdf Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.332478 Permissions Required, VDB Entry
- https://vuldb.com/?id.332478 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.685540 Third Party Advisory, VDB Entry
- https://www.dlink.com/ Product
- https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(gena.cgi).pdf Exploit, Third Party Advisory