CVE-2014-125117 is a critical (CVSS 9.8) stack-based buffer overflow in the my_cgi.cgi component of certain D-Link devices, tested on the DSP-W215 smart plug at firmware 1.02. A crafted POST request to the info.cgi path gives unauthenticated remote code execution. No fixed version is confirmed.
What's affected
D-Link DSP-W215, tested at firmware version 1.02, per the record and VulnCheck. The record says certain D-Link devices are affected, and VulnCheck adds that it likely affects many D-Link products and that the version range is undefined.
The flaw is in the my_cgi.cgi component and is reached through a POST request to /common/info.cgi. It needs no authentication and runs with system level privileges.
I could not confirm a fixed firmware from the sources available. Check D-Link support for each device that uses the same web component, and check whether the model still gets updates.
How to check if you're exposed
Find the device's firmware version in its web or app interface. A DSP-W215 on 1.02 is in scope.
Find all D-Link devices on your networks. A scan of a subnet you manage can list web servers, and the page titles or banners can identify them:
nmap -sV -p 80,8080 --open 192.168.0.0/24
Smart plugs often live on guest or home networks, so check those too. Review whether any such device is exposed to the internet through port forwarding or a cloud relay you did not configure.
What to do now
- List smart plugs, cameras and other D-Link devices, with their model and firmware.
- Check D-Link support for fixed firmware. If the model is out of support, replace it.
- Put IoT devices on a separate network segment with no route to sensitive systems.
- Do not forward ports to these devices from the internet.
- Unplug and replace a device you suspect has been tampered with.
Why it matters
The class is CWE-121 (Stack-based Buffer Overflow) with CWE-20 (Improper Input Validation) as a second label. A CGI program copies the contents of a request into a fixed buffer and does not check how long it is. On embedded devices, the program runs with high privileges and the device has few defences, so overwriting the stack can give full control.
A smart plug is a small device, but it sits on your network with a persistent connection. That makes it a foothold. Segmenting IoT devices from business systems limits what a compromise can reach.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Which devices are affected?
The record names the DSP-W215 at firmware 1.02, and VulnCheck says other D-Link products may share the code. Check the vendor for your model.
Is login required?
No. The record describes an unauthenticated attacker.
Sources
Last reviewed: 19 October 2026.
