The DSP-W215 is an end-of-life device with serious, unpatchable security weaknesses. This page summarises them so you can deploy it sensibly. Findings were verified by reverse-engineering the firmware (hardware rev A1, firmware 1.14/1.24); protocol specifics are in protocol.md.
One-line guidance: treat the plug as untrusted hardware — put it on an isolated IoT VLAN with no Internet access, control it locally (this tool talks only to the device on your LAN; it has no cloud dependency), and never expose it to the WAN.
| CVE | Summary | Auth | Status on current firmware |
|---|---|---|---|
| CVE-2014-3936 | Stack overflow in do_hnap() in my_cgi.cgi (long Content-Length on a GetDeviceSettings HNAP request) → root RCE |
none (pre-auth) | Fixed in 1.02b05 — so update past 1.0x. The factory 1.00 firmware is exploitable. |
| CVE-2015-2051 | D-Link HNAP SOAPAction-header OS command injection → auth bypass / command exec |
none (pre-auth) | Same HNAP do_hnap code family is present on this device lineage. |
Both bugs are reachable before authentication, which is why they were remotely exploitable by anyone able to reach the device's web port.
- Shared TLS private key. Every unit ships the same D-Link RSA key /
self-signed cert (
CN=dlinkrouter). The key is in the public firmware, so the device's HTTPS gives no protection against man-in-the-middle. - PIN-only auth over plaintext HTTP. The 6-digit label PIN is the only secret; HNAP uses MD5/HMAC-MD5 with a session timestamp fixed at login and reused, so signed requests are replayable on the local segment.
- End-of-life software stack: Linux 2.6.31 (2009), BusyBox 1.01 (2005), OpenSSL 1.0.0m, uClibc 0.9.30, lighttpd 1.4.28-devel, wpa_supplicant 0.8 — all long unsupported, with many public CVEs and no further vendor fixes.
- Firmware updates are not signed — fetched via
wgetfrom a server-supplied URL with only a header checksum (integrity, not authenticity). - Reversible Wi-Fi key obfuscation. Stored PSKs use a fixed, firmware-embedded routine (shared across devices), not real per-device encryption.
- Unauthenticated info disclosure.
GetDeviceSettings(model, firmware, MAC) andPOST /my_cgi.cgi request=create_chklst(live power) respond without credentials. (This tool'spowercommand uses the latter as a fallback.) - Debug services present.
telnetd/tftpdBusyBox applets are in the image (not auto-started in the firmware reviewed, but present).
Do
- Update to the latest firmware (1.24B01B) — closes CVE-2014-3936 vs the factory image.
- Isolate the plug on an IoT VLAN / separate SSID; block its Internet egress and allow only your controller (Home Assistant / this tool) to reach it.
- Never port-forward it; disable router UPnP (the firmware contains
upnpchelpers that can open ports). - Control it locally — this package is local-only by design.
- Use a unique Wi-Fi PSK for the IoT network (the plug stores PSKs weakly and is 2.4 GHz / WPA2-max).
Don't
- Don't place it on a flat LAN with PCs/phones/NAS.
- Don't rely on its HTTPS for confidentiality (shared key).
- Don't expect future security patches — there will be none.
Consider
- For metering without this legacy stack, a modern Tasmota/ESPHome plug is a maintained, local-only, signed-OTA alternative. (The DSP-W215 cannot be re-flashed to open firmware.)
- NVD — CVE-2014-3936
- CVE-2014-3936 details
- Rapid7 — D-Link HNAP SOAPAction command execution (CVE-2015-2051)
- FortiGuard — HNAP SOAPAction-Header command execution
- FortiGuard — HNAP request remote buffer overflow
- Exploit-DB 34064 — D-Link HNAP buffer overflow
- Original DSP-W215 HNAP research by Craig Heffner (
/dev/ttyS0).