D-Link DCS-6010L CVE-2025-8155

Exploitation requires: (1) authenticated access to the DCS-6010L management interface, meaning the attacker must either possess valid credentials or have access to a network where an authenticated user is already logged in; (2) user interaction (UI:P) - the victim must visit a crafted URL containing the malicious paratest parameter while their browser maintains an active session with the camera; (3) the camera must be reachable via HTTP/HTTPS from the attacker's network position or the victim's location. The vulnerability does NOT require special configuration or non-default settings - it exists in the base firmware. However, if the management interface is restricted to a trusted internal network by firewall rules or air-gapped deployment, the attack surface is effectively zero. The paratest parameter must be processed by the /vb.htm endpoint, which is part of the standard Management Application bundle in firmware 1.15.03.

This vulnerability presents minimal real-world risk despite CWE-79 classification. CVSS 4.0 score of 2.0 reflects extremely low severity: network-accessible but requires both authentication (PR:L) and user interaction (UI:P), with only integrity impact (VI:L) to the session. EPSS score of 0.05% (15th percentile) indicates very low exploitation probability across real-world networks, consistent with it being an end-of-life product with limited active deployments. The public availability of exploit code (E:P) is partially offset by the authentication barrier - a remote unauthenticated attacker cannot leverage the published POC without first obtaining valid credentials. The vendor provides no support for this product line, eliminating official patching as a viable remediation path. Real-world priority should be LOW unless the organization has documented active DCS-6010L deployments and can confirm web access to the management interface from untrusted networks. For air-gapped or segmented camera networks, risk is negligible.

An attacker crafts a malicious URL containing JavaScript in the paratest parameter (e.g., /vb.htm?paratest=<script>alert('xss')</script>) and sends it via email or messaging to a network administrator who is logged into the DCS-6010L management interface. When the administrator clicks the link, the JavaScript executes in their browser session, potentially allowing the attacker to steal authentication cookies, redirect to a phishing page, or perform unauthorized configuration changes (firmware upload, access rule modifications). This requires the victim to be authenticated and to interact with the crafted link - neither of which can be forced remotely.