D-Link DCS-935L CVE-2026-13545

Exploitation requires network reachability to the camera's HTTP management interface and a low-privilege authenticated session (CVSS PR:L), after which a single crafted POST to setconf.cgi with a malicious UID parameter triggers command injection - no user interaction (UI:N) and low attack complexity (AC:L). Limiting factors: the attacker must possess or obtain valid credentials/session (mitigated in practice by weak/default passwords common on consumer cameras), the target must be the DCS-935L running the vulnerable firmware (1.10.01), and the management interface must be reachable from the attacker's position; a camera behind NAT with no port-forwarding and strong unique credentials is substantially harder to exploit.

Signals are moderately strong but not at emergency level. The CVSS 4.0 base score is 7.4 with AV:N/AC:L/AT:N/PR:L/UI:N and high VC/VI/VA, indicating a network-reachable, low-complexity attack that requires some privilege level and yields full device compromise. The exploit maturity is marked E:P (proof-of-concept), consistent with the publicly disclosed PoC on GitHub. This is NOT in CISA KEV and there is no EPSS score provided, so widespread automated exploitation is not confirmed - treat the PoC as a real but not yet weaponized-at-scale threat. The key tension: PR:L implies the attacker first needs valid credentials or a session, which limits unauthenticated mass exploitation; however, consumer cameras frequently ship with weak/default credentials, which can collapse that barrier in practice. Net: a genuine priority for anyone running this specific EOL camera exposed to a network, but the limited deployment footprint and authentication requirement temper the broader urgency.

An attacker who can reach the camera's web interface and obtain a low-privilege session (e.g. via default or guessed credentials, or an existing operator account) sends a crafted POST request to setconf.cgi with shell metacharacters embedded in the UID parameter. The sub_400E40 handler passes this directly to an OS command, executing the attacker's payload - likely as root - to plant a backdoor, pivot into the local network, or enslave the camera into a botnet. A public proof-of-concept for this exact path is available on GitHub, lowering the effort required.