CVE:CVE-2014-3936
CNNVD:CNNVD-201406-009
D-Link DSP-W215、DIR-505和DIR-505L都是友讯（D-Link）公司的产品。D-Link DSP-W215是一款Wi-Fi智能插座；D-Link DIR-505和DIR-505L都是便携式无线路由器。
多款D-Link产品中的www/my_cgi.cgi文件的‘do_hnap’函数存在基于栈的缓冲区溢出漏洞。远程攻击者可借助‘GetDeviceSettings’HNAP请求中长的Content-Length头利用该漏洞执行任意代码。以下版本受到影响：使用1.01b06及之前版本固件的D-Link DSP-W215 (Rev. A1)，使用1.07及之前版本固件的DIR-505，使用1.01及之前版本固件的DIR-505L。
solution:Upgrade dlink dir505_shareport_mobile_companion_firmware to a higher version than 1.07,and avoid the version (,1.07]; Upgrade dlink dir505_shareport_mobile_companion to a higher version than a1,and avoid the version a1; Upgrade dlink dir505l_shareport_mobile_companion_firmware to a higher version than 1.01,and avoid the version (,1.01]; Upgrade dlink dir-505l_shareport_mobile_companion to a higher version than a1,and avoid the version a1; Upgrade dlink dsp-w215_firmware to a higher version than *:b06,and avoid the version *:b06; Upgrade dlink dsp-w215 to a higher version than a1,and avoid the version a1