D-Link DCS-5615 CVE-2026-11497

The Boa web server on the DCS-5615 must be network-reachable - the CVSS vector confirms AV:N/AC:L/AT:N/PR:N/UI:N, meaning no authentication, no user interaction, and no special network position (e.g., same subnet) is required; direct internet exposure is sufficient. The vulnerability is specific to firmware version 1.01.00 of the DCS-5615 and the Boa web server component governed by /etc/conf.d/boa/boa.conf. No non-default configuration trigger is identified in the available description, suggesting this affects the default Boa deployment on this firmware. Exploitation is limited to systems running this exact firmware line; other D-Link camera models are not confirmed affected. The low integrity impact (VI:L) and absence of scope change (SC:N/SI:N/SA:N) indicate the attack does not pivot to other systems from the camera itself based on available CVSS data.

The CVSS 4.0 base score of 5.5 (Medium) is shaped by a low integrity impact (VI:L) and no confidentiality or availability impact in the primary scope, which tempers the raw severity. However, the vector components AV:N/AC:L/AT:N/PR:N/UI:N confirm this is a no-authentication, low-complexity, network-accessible vulnerability - the most dangerous class of attack surface profile for an IoT device. The E:P (Proof of Concept) supplemental metric elevates practical exploitability beyond what the base score suggests. No EPSS score was provided, limiting probabilistic exploitation likelihood assessment. The absence of a CISA KEV listing means confirmed mass exploitation has not been observed, but PoC availability on IoT camera vulnerabilities historically shortens the window before opportunistic scanning occurs. D-Link cameras are routinely exposed directly to the internet by home and small-business users without firewall intermediaries, making the effective attack surface substantially broader than enterprise environments. The contradiction between the 'Information Disclosure' tag and VC:N in the CVSS vector should be flagged: defenders should verify with the vendor or VulDB CTI feed whether sensitive configuration data (credentials, RTSP stream URLs, network settings) is accessible through this attack path, as that would meaningfully change the risk profile beyond the base score.

An attacker conducting opportunistic scanning of internet-exposed D-Link DCS-5615 cameras on port 80 or 8080 identifies a target running firmware 1.01.00. Using the publicly available proof-of-concept (referenced via the Notion link in CVE references), the attacker sends a crafted HTTP request to the Boa web server that manipulates or abuses the /etc/conf.d/boa/boa.conf configuration handling, triggering the least privilege violation and gaining access to functionality or data beyond their authorization level - potentially including camera configuration, stored credentials, or network settings.