D-Link Dsp-w215 Firmware vulnerabilities

5 CVEs affecting D-Link Dsp-w215 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-125117, published 2025-07-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-3936, published 2014-06-02. High severity, CVSS 10.0. EPSS: 76.6% chance of exploitation in the next 30 days. Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware…
CVE-2014-125117, published 2025-07-25. Critical severity, CVSS 9.8. EPSS: 7.9% chance of exploitation in the next 30 days. A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to…
CVE-2020-13136, published 2020-05-18. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. D-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a network sniffer.
CVE-2021-29295, published 2021-08-10. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via usr/bin/lighttpd. It could be triggered by sending an HTTP…
CVE-2020-13135, published 2020-05-18. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy.