Which versions of D-Link DCS-935L are affected by CVE-2026-12174?

D-Link DCS-935L IP cameras (version 1.10.01 and earlier) contain a format string vulnerability allowing authenticated attackers to achieve remote code execution or information disclosure through…

Is there a public PoC exploit available for CVE-2026-12174?

Yes, a public proof-of-concept exploit is available for CVE-2026-12174. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12174?

Within 24 hours: Inventory all D-Link DCS-935L cameras; identify those running version 1.10.01 or earlier; document network segments where these cameras operate. Within 7 days: Implement network segmentation restricting camera access to isolated, trusted administrative networks only; apply firewall rules to block unnecessary inbound connections; enforce strong credentials on all camera accounts and disable remote HTTP access if operationally feasible. Within 30 days: Evaluate replacement with alternative camera vendors with current security patches; establish monitoring of D-Link security advisories for patch releases; develop firmware upgrade plan if D-Link releases patched versions beyond 1.10.01.

D-Link DCS-935L CVE-2026-12174

Q: What is the CVSS score of CVE-2026-12174?

CVE-2026-12174 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-06-13 VulDB

Information Disclosure D-Link Dcs 935L D-Link

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable HTTP handler with low complexity; PR:L mirrors the vendor vector since web UI authentication is required, and a format-string primitive plausibly yields full C/I/A impact on the device.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 13, 2026 - 21:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 13, 2026 - 21:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 13, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jun 13, 2026 - 21:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 13, 2026 - 20:46 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Format string vulnerability in the D-Link DCS-935L 1.10.01 IP camera allows authenticated remote attackers to corrupt memory and likely achieve information disclosure or code execution by manipulating the data argument passed to snprintf within the /web/cgi-bin/greece/rhea HTTP handler. Publicly available exploit code exists per VulDB submission, though this CVE is not on the CISA KEV list. The CVSS 4.0 score of 7.4 reflects high impact on confidentiality, integrity, and availability with low-privilege authentication required.

Technical ContextAI

The D-Link DCS-935L is a consumer-grade Wi-Fi network camera. The flaw is classified as CWE-134 (Use of Externally-Controlled Format String), a class of bug where user-supplied input is passed directly as the format string parameter of a printf-family function - here, snprintf - instead of being passed as a data argument. This allows an attacker to inject format specifiers such as %x, %s, or %n, which the C runtime interprets to read arbitrary stack memory, leak pointers, or write to controlled addresses. The vulnerable code path lives in the HTTP handler binary serving /web/cgi-bin/greece/rhea, meaning the attack surface is reachable over the camera's web management interface. Affected CPE is cpe:2.3:a:d-link:dcs-935l:*:*:*:*:*:*:*:* with no upper version bound currently specified.

RemediationAI

No vendor-released patch identified at time of analysis; the DCS-935L is a legacy model and no D-Link advisory or fixed firmware version has been published in the supplied references. As compensating controls, isolate the camera on a segmented IoT VLAN with no inbound internet exposure, block external access to TCP/80 and TCP/443 on the device, and place the management interface behind a VPN - trade-off is loss of remote mobile-app access via the public cloud relay. Replace default and weak admin credentials with long random passwords to make the PR:L barrier meaningful, recognizing this does not remove the underlying bug. Where feasible, retire and replace the camera with a currently supported model, since end-of-life firmware is unlikely to receive a fix. Monitor https://vuldb.com/vuln/370815 and the vendor advisory page at https://www.dlink.com/ for any future firmware update.