Read the docs
TI-2016-04936 Aliases CVE-2016-5681GHSA-x7m8-97xv-fx44

Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05…

Priority MEDIUM 56CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 1.11 before 1.11WWb04, DIR-890L A1 1.09 before 1.09b14, DIR-885L A1 1.11 before 1.11WWb07, DIR-880L A1 1.07 before 1.07WWb08, DIR-868L B1 2.03 before 2.03WWb01, and DIR-868L C1 3.00 before 3.00WWb01 devices allows remote attackers to execute arbitrary code via a long session cookie.

Why it matters now

EPSS 0.11927 96th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:*up to 2.03VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dir-868l:b1:*:*:*:*:*:*:*b1Running onD-Link Japan K.K.
cpe:2.3:o:dlink:dir-822_firmware:3.01:*:*:*:*:*:*:*3.01VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dir-822:a1:*:*:*:*:*:*:*a1Running onD-Link Japan K.K.
cpe:2.3:o:d-link:dir-880l_firmware:*:*:*:*:*:*:*:*up to 1.07VulnerableD-Link
cpe:2.3:h:dlink:dir-880l:a1:*:*:*:*:*:*:*a1Running onD-Link Japan K.K.
cpe:2.3:o:d-link:dir-850l_firmare:*:*:*:*:*:*:*:*up to 2.07VulnerableD-Link
cpe:2.3:h:dlink:dir-850l:b1:*:*:*:*:*:*:*b1Running onD-Link Japan K.K.
cpe:2.3:o:d-link:dir-895l_firmware:*:*:*:*:*:*:*:*up to 1.11VulnerableD-Link
cpe:2.3:h:dlink:dir-895l:a1:*:*:*:*:*:*:*a1Running onD-Link Japan K.K.
  • cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:* Versions up to 2.03 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dir-868l:b1:*:*:*:*:*:*:* Versions b1 Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dir-822_firmware:3.01:*:*:*:*:*:*:* Versions 3.01 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dir-822:a1:*:*:*:*:*:*:* Versions a1 Running on ·D-Link Japan K.K.
  • cpe:2.3:o:d-link:dir-880l_firmware:*:*:*:*:*:*:*:* Versions up to 1.07 Vulnerable ·D-Link
  • cpe:2.3:h:dlink:dir-880l:a1:*:*:*:*:*:*:* Versions a1 Running on ·D-Link Japan K.K.
  • cpe:2.3:o:d-link:dir-850l_firmare:*:*:*:*:*:*:*:* Versions up to 2.07 Vulnerable ·D-Link
  • cpe:2.3:h:dlink:dir-850l:b1:*:*:*:*:*:*:* Versions b1 Running on ·D-Link Japan K.K.
  • cpe:2.3:o:d-link:dir-895l_firmware:*:*:*:*:*:*:*:* Versions up to 1.11 Vulnerable ·D-Link
  • cpe:2.3:h:dlink:dir-895l:a1:*:*:*:*:*:*:* Versions a1 Running on ·D-Link Japan K.K.
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:d-link:dir-817l\(w\)_firmware:*:*:*:*:*:*:*:*up to jul.2016VulnerableD-Link
cpe:2.3:h:dlink:dir-817l\(w\):ax:*:*:*:*:*:*:*axRunning onD-Link Japan K.K.
cpe:2.3:o:d-link:dir-818l\(w\)_firmware:*:*:*:*:*:*:*:*up to 2.05VulnerableD-Link
cpe:2.3:h:dlink:dir-818l\(w\):ax:*:*:*:*:*:*:*axRunning onD-Link Japan K.K.
cpe:2.3:o:d-link:dir-890l_firmware:*:*:*:*:*:*:*:*up to 1.09VulnerableD-Link
cpe:2.3:h:dlink:dir-890l:a1:*:*:*:*:*:*:*a1Running onD-Link Japan K.K.
cpe:2.3:o:d-link:dir-823_firmware:*:*:*:*:*:*:*:*up to 1.00VulnerableD-Link
cpe:2.3:h:dlink:dir-823:a1:*:*:*:*:*:*:*a1Running onD-Link Japan K.K.
cpe:2.3:o:d-link:dir-885l_firmware:*:*:*:*:*:*:*:*up to 1.11VulnerableD-Link
cpe:2.3:h:dlink:dir-885l:a1:*:*:*:*:*:*:*a1Running onD-Link Japan K.K.
cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:*up to 3.00VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dir-868l:c1:*:*:*:*:*:*:*c1Running onD-Link Japan K.K.
  • cpe:2.3:o:d-link:dir-817l\(w\)_firmware:*:*:*:*:*:*:*:* Versions up to jul.2016 Vulnerable ·D-Link
  • cpe:2.3:h:dlink:dir-817l\(w\):ax:*:*:*:*:*:*:* Versions ax Running on ·D-Link Japan K.K.
  • cpe:2.3:o:d-link:dir-818l\(w\)_firmware:*:*:*:*:*:*:*:* Versions up to 2.05 Vulnerable ·D-Link
  • cpe:2.3:h:dlink:dir-818l\(w\):ax:*:*:*:*:*:*:* Versions ax Running on ·D-Link Japan K.K.
  • cpe:2.3:o:d-link:dir-890l_firmware:*:*:*:*:*:*:*:* Versions up to 1.09 Vulnerable ·D-Link
  • cpe:2.3:h:dlink:dir-890l:a1:*:*:*:*:*:*:* Versions a1 Running on ·D-Link Japan K.K.
  • cpe:2.3:o:d-link:dir-823_firmware:*:*:*:*:*:*:*:* Versions up to 1.00 Vulnerable ·D-Link
  • cpe:2.3:h:dlink:dir-823:a1:*:*:*:*:*:*:* Versions a1 Running on ·D-Link Japan K.K.
  • cpe:2.3:o:d-link:dir-885l_firmware:*:*:*:*:*:*:*:* Versions up to 1.11 Vulnerable ·D-Link
  • cpe:2.3:h:dlink:dir-885l:a1:*:*:*:*:*:*:* Versions a1 Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:* Versions up to 3.00 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dir-868l:c1:*:*:*:*:*:*:* Versions c1 Running on ·D-Link Japan K.K.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-5681
  2. 2026-10-03 Alias added: GHSA-x7m8-97xv-fx44

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences