What is CVE-2014-125117?

CVE-2014-125117 is a critical-severity vulnerability in D-Link Dsp-W215, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2025-07-25.

How severe is CVE-2014-125117?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2014-125117 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in D-Link Dsp-W215

CVE-2014-125117

A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthenticated attacker to achieve remote code execution with system-level privileges.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2025-07-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.072 (94.1th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.050 · newest: 0.072 · change: +0.022

Affected products

D-Link Dsp-W215 — versions 1.02
Dlink Dsp-W215
Dlink Dsp-W215 Firmware — versions 1.02

Weakness classification (CWE)

Public proof-of-concept exploits

rapid7/metasploit-framework

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/l… (Exploit, exploit)
www.exploit-db.com/exploits/34063 (Exploit, exploit)
web.archive.org/web/20140525215526/http://www.devttys0.com/2014/05/hacking-the-… (Exploit, technical-description, Third Party Advisory, exploit)
www.fortiguard.com/encyclopedia/ips/38932/d-link-info-cgi-post-request-buffer-o… (Third Party Advisory, third-party-advisory)
www.vulncheck.com/advisories/dlink-stack-based-buffer-overflow-rce (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2014-125117?: CVE-2014-125117 is a critical-severity vulnerability in D-Link Dsp-W215, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2025-07-25.
How severe is CVE-2014-125117?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2014-125117 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.