CVE-2016-1558 Memory corruption in n/a
Remote attackers can exploit a buffer overflow in D-Link access points via a crafted cookie, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-1558?
CVE-2016-1558 is a critical memory corruption vulnerability in n/a, published on 21 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. B1 3.05 and earlier, DAP-2660 1.11 and earlier, DAP-2690 3.15 and earlier, DAP-2695 1.16 and earlier, DAP-3320 1.00 and earlier, and DAP-3662 1.01 and earlier allows remote attackers to have unspecified impact via a crafted 'dlink_uid' cookie.
Weakness: CWE-119
Which versions are affected by CVE-2016-1558?
It affects 10 products.
Products include Dlink Dap-2230 Firmware, Dlink Dap-2310 Firmware, Dlink Dap-2330 Firmware, Dlink Dap-2360 Firmware, Dlink Dap-2553 Firmware, Dlink Dap-2660 Firmware and 4 more.
How do I fix CVE-2016-1558?
No fix has been published for CVE-2016-1558 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-1558 being exploited?
There is no known exploitation of CVE-2016-1558 in the wild and no public exploit code.
Sources
Also known as GHSA-88pq-qj92-q92g.