What is the CVSS score of CVE-2026-36983?

CVE-2026-36983 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of D-Link DCS-932L are affected by CVE-2026-36983?

CVE-2026-36983 is a remote command injection vulnerability affecting D-Link DCS-932L v2.18.01 IP cameras that allows unauthenticated attackers to execute arbitrary commands on affected devices.

How to fix or mitigate CVE-2026-36983?

Within 24 hours: Inventory all D-Link DCS-932L devices across the network and isolate any running v2.18.01 from trusted network segments. Within 7 days: Implement network segmentation to restrict DCS-932L camera access to dedicated VLAN with strict egress filtering; disable remote management interfaces if enabled. Within 30 days: Execute replacement or retirement plan-D-Link has not released patches for this end-of-life model; evaluate migration to supported camera platforms with current security posture.

D-Link DCS-932L CVE-2026-36983

EUVD-2026-29113 HIGH

Command Injection (CWE-77)

2026-05-11 mitre

GHSA-q7j6-fj2r-2q6g

D-Link Command Injection

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 17:46 vuln.today

CVSS changed

May 12, 2026 - 15:22 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

DescriptionCVE.org

D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd. The manipulation of the argument LightSensorControl leads to command injection.

AnalysisAI

Command injection in D-Link DCS-932L v2.18.01 allows remote unauthenticated attackers to execute arbitrary system commands via the LightSensorControl parameter in the /bin/alphapd binary. CVSS 7.3 indicates network-accessible exploitation with low complexity requiring no authentication or user interaction, though EPSS score of 0.15% (35th percentile) suggests low observed exploitation probability. No CISA KEV listing or confirmed active exploitation. Publicly documented vulnerability details exist on GitHub, increasing risk of future exploitation attempts against this end-of-life IoT camera model.

Technical ContextAI

The vulnerability affects the alphapd daemon binary running on D-Link DCS-932L wireless IP cameras at version 2.18.01. The flaw is a CWE-77 OS command injection in function sub_42EF14, where the LightSensorControl parameter lacks proper input sanitization before being passed to system shell commands. This is a classic IoT firmware vulnerability pattern where web interface parameters are directly concatenated into shell commands without validation or escaping. The affected device is a network-connected surveillance camera with embedded Linux firmware, making it part of the attack surface for IoT botnets. CPE data shows incomplete product identification (cpe:2.3:a:n/a:n/a), but the specific product is confirmed as D-Link DCS-932L from the description and GitHub reference.

RemediationAI

D-Link has not released a patched firmware version for the DCS-932L v2.18.01 according to available vendor advisories at time of analysis. For internet-facing deployments, implement compensating controls immediately: disable remote access to the camera's web interface and restrict access to trusted internal networks only via firewall rules blocking external access to TCP ports 80/443/8080. If light sensor functionality is not operationally required, disable the LightSensorControl feature through the camera's administrative interface to eliminate the attack vector. For environments requiring remote access, place cameras behind a VPN gateway requiring authentication, which mitigates the PR:N (no privileges required) attack prerequisite. Consider replacing DCS-932L devices with actively supported camera models that receive security updates, as this EOL product is unlikely to receive future patches. Monitor D-Link security bulletin (https://www.dlink.com/en/security-bulletin/) for potential future advisories. Network segmentation placing IoT cameras on isolated VLANs prevents lateral movement if exploitation occurs, though this does not prevent initial compromise.