Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was identified in D-Link DHP-1320 1.00WWB04. This affects the function redirect_count_down_page of the component SOAP Handler. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Stack-based buffer overflow in D-Link DHP-1320 PowerLine AV adapter (firmware 1.00WWB04) allows remote authenticated attackers to execute arbitrary code with full device control via malformed SOAP requests to the redirect_count_down_page function. Publicly available exploit code exists on GitHub (confirmed by VulDB). EPSS score of 0.04% (14th percentile) indicates low observed exploitation in the wild despite POC availability. Product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices.
Technical ContextAI
This vulnerability affects the SOAP (Simple Object Access Protocol) handler implementation in D-Link DHP-1320 PowerLine network adapters, which use SOAP for remote device management and configuration. The stack-based buffer overflow (CWE-121) occurs in the redirect_count_down_page function when processing SOAP requests. PowerLine adapters transmit network data over electrical wiring and often include web-based management interfaces that accept SOAP commands for configuration. A stack-based buffer overflow overwrites the call stack with attacker-controlled data, allowing execution flow hijacking and arbitrary code execution at the privilege level of the SOAP handler process. The CPE identifier cpe:2.3:a:d-link:dhp-1320 confirms the D-Link DHP-1320 as the sole affected product.
RemediationAI
No vendor-released patch exists or will be developed as D-Link discontinued the DHP-1320 product line and ended security support. IMMEDIATE ACTION REQUIRED: Replace all DHP-1320 devices with currently supported PowerLine adapters or alternative networking solutions from active product lines. Organizations unable to immediately replace devices must implement network segmentation to isolate DHP-1320 adapters on separate VLANs with strict firewall rules blocking all inbound management traffic from untrusted networks. Disable SOAP-based remote management interfaces entirely if the device supports local-only configuration (verify in firmware settings under remote access controls). Implement strong authentication credentials if remote management cannot be disabled, though this only raises attacker cost without eliminating the vulnerability. Monitor network traffic to DHP-1320 management ports (typically TCP 80/443) for anomalous SOAP request patterns as detection control. Note that all mitigations except hardware replacement are temporary compensating controls with operational trade-offs: disabling remote management prevents legitimate remote administration, network isolation adds configuration complexity, and credential strengthening does not prevent exploitation by attackers who obtain valid credentials through phishing or credential reuse.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-14260
GHSA-95m4-fmhv-g399