D-Link DI-8400 vulnerabilities

A stack-based buffer overflow vulnerability has been discovered in D-Link DI-8400 version 16.07 in the function menu_nat_more_asp of the file menu_nat_more.asp (Web Administration Service component). Manipulation of the argument opt allows remote attack. The exploit is public.

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the DDNS Configuration component. Manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been released to the public and may be used for attacks.

In D-Link DI-8400 up to version 16.07.26A1, a stack-based buffer overflow exists in /dbsrv.asp when manipulating the str argument. Remote exploitation is possible. The exploit is public. The researcher noted conflicting parameter names.