CVE-2014-125117 CRITICAL

CVE-2014-125117: D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE

Vendor D-Link

Product DSP-W215

Weakness CWE-121

Published July 25, 2025

Last update April 7, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthenticated attacker to achieve remote code execution with system-level privileges.

Key dates

02Disclosure timeline

July 25, 2025 CVE published

April 7, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2014-125117 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/121.html

Related vulnerabilities

04Related CVE

CVE-2024-23934 Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2023-27590 Rizin has stack-based buffer overflow when parsing GDB registers profile files CVE-2020-37138 10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP) CVE-2021-42529 XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution CVE-2021-1177 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities