D-Link DCS-935L CVE-2026-12174

Requires network reachability to the camera's web management interface (typically TCP/80 or TCP/443 on the LAN, or the internet if port-forwarded) and valid low-privilege web UI credentials per CVSS PR:L - exploitation is not possible against an unauthenticated attacker who cannot log in. The specific vulnerable endpoint is /web/cgi-bin/greece/rhea, and the attacker must control the data argument passed to the snprintf call inside that HTTP handler. Limiting factors: D-Link DCS-935L firmware 1.10.01 (and likely earlier 1.x) is the only confirmed affected build, the device must be powered on and reachable, and the attacker needs at least one working web UI account - though widespread default/weak credentials on this consumer camera substantially weaken that limit.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation with low complexity and authenticated low-privilege access, with high VC/VI/VA impacts - consistent with a format-string primitive that can leak memory and potentially achieve code execution on an embedded device. Publicly available exploit code exists per the linked GitHub PoC, raising real-world risk for any internet-exposed DCS-935L. However, the device is end-of-life consumer hardware, and the CVE is not present in CISA KEV; no EPSS score was provided in the input. The PR:L requirement (web UI credentials) is a meaningful limiting factor against drive-by mass exploitation, but DCS-935L cameras are widely deployed with default or weak credentials, which materially erodes that protection. Net assessment: a real priority for any organization or home user still operating this model - especially if the camera's admin interface is exposed to untrusted networks - and a lower priority where the device sits behind firewalls and uses strong credentials.

An attacker on the same network as an exposed DCS-935L (or reaching it over the internet via port-forwarded admin UI) authenticates with default, reused, or low-privilege credentials and sends a crafted HTTP request to /web/cgi-bin/greece/rhea with format specifiers embedded in the data parameter. The snprintf call interprets the specifiers, leaking stack memory containing session tokens or pointers, and with a %n primitive can corrupt memory to hijack control flow and execute attacker-supplied code on the camera. Publicly available exploit code in the linked GitHub repository lowers the skill barrier significantly.