D-Link DCS-5615 CVE-2026-11497

The Boa HTTP server is a lightweight, single-threaded web server widely embedded in consumer IoT and IP camera firmware due to its minimal resource footprint. In the D-Link DCS-5615 running firmware 1.01.00, the Boa server's configuration resides at /etc/conf.d/boa/boa.conf and governs critical runtime parameters including process privilege levels, CGI execution contexts, and document root permissions. CWE-272 (Least Privilege Violation) identifies the root cause as the server or an associated component operating with a privilege level beyond what is functionally necessary - a common firmware design flaw in embedded cameras where services run as root or with broad file-system access. This over-privilege exposure, when coupled with a remotely exploitable manipulation vector in the Boa configuration handling, allows an attacker to leverage those excess privileges. The CPE string cpe:2.3:a:d-link:dcs-5615:*:*:*:*:*:*:*:* covers all sub-versions of this firmware line, though the confirmed affected version per EUVD-2026-35027 is specifically 1.01.00. Notably, the vulnerability tag includes 'Information Disclosure' despite the CVSS vector showing VC:N (no confidentiality impact to the vulnerable system); this discrepancy suggests the disclosure component may affect subsequent systems or configuration data rather than direct memory/data exfiltration from the camera itself.