EUVD-2026-40045
GHSA-9rhw-hmqw-p7m4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CGI with low-complexity injection but a required low-privilege session (PR:L); command execution on embedded firmware yields full C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Parameter Handler. Such manipulation of the argument UID leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
OS command injection in the D-Link DCS-935L Wi-Fi network camera (firmware 1.10.01) lets a remote attacker inject arbitrary operating-system commands through the UID POST parameter handled by the sub_400E40 function in setconf.cgi. The CVSS 4.0 vector requires low privileges (PR:L), so an attacker needs some level of authenticated/session access, after which they gain full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as actively exploited in the wild.
Technical ContextAI
The DCS-935L is a consumer/SOHO mydlink-enabled Wi-Fi IP camera that exposes a web/CGI management interface. The flaw is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue: the setconf.cgi handler (function sub_400E40, identified from binary analysis) passes the attacker-controlled UID POST parameter into an OS-level command (e.g. a shell call or system() invocation) without sanitization, allowing shell metacharacters to break out and execute arbitrary commands. The CPE cpe:2.3:a:d-link:dcs-935l:*:*:*:*:*:*:*:* identifies the affected product; the specific firmware called out is 1.10.01. Embedded Linux camera firmware typically runs CGI binaries as root, so command injection commonly yields root-level execution.
RemediationAI
No vendor-released patch identified at time of analysis - the DCS-935L is a legacy mydlink camera and may be end-of-life, so confirm patch availability directly with D-Link at https://www.dlink.com/ (vulnerability details: https://vuldb.com/cve/CVE-2026-13545). In the absence of a fix, apply specific compensating controls: remove the camera from direct internet exposure and block inbound access to its web/CGI management port at the perimeter firewall (trade-off: loses remote viewing via the device's own interface); place the camera on an isolated VLAN/segment that cannot reach sensitive hosts and restrict management access to a trusted admin workstation only (trade-off: added network configuration overhead); change all default/weak credentials to strong unique passwords since PR:L exploitation hinges on having a session (trade-off: minimal). Given EOL status, the strongest long-term remediation is to replace the device with a supported model.
Format string vulnerability in the D-Link DCS-935L 1.10.01 IP camera allows authenticated remote attackers to corrupt me
Buffer overflow in D-Link DCS-935L camera firmware versions up to 1.10.01 allows authenticated remote attackers to achie
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today