D-Link DCS-935L CVE-2026-8260

Requires valid administrative credentials to the D-Link DCS-935L HNAP service (CVSS:4.0/PR:L indicates low-privilege authentication required). The SetDeviceSettings function is accessible only to authenticated users with administrative rights to modify device configuration. Exploitation is possible against default network-accessible configurations where the HNAP service listens on standard HTTP/HTTPS ports. No user interaction required (UI:N) and low attack complexity (AC:L) mean exploitation is straightforward once authentication is achieved. Limiting factors: (1) authentication requirement reduces exposure compared to unauthenticated RCE, (2) requires camera to be network-reachable from attacker position (internet-exposed or same internal network), (3) effectiveness depends on predictable memory layout and ASLR/DEP absence in firmware version 1.10.01.

Real-world risk is MODERATE-HIGH for internet-exposed cameras with weak credentials, but LIMITED for properly secured deployments. Analysis of multiple risk signals: CVSS 4.0 base score of 7.4 reflects high technical impact but requires authentication (PR:L), which significantly reduces attack surface compared to unauthenticated vulnerabilities. The CVSS:4.0/E:P (Proof-of-concept) indicator is confirmed by the GitHub repository containing working exploit code. However, this CVE is NOT listed in CISA KEV, suggesting no confirmed widespread exploitation in enterprise environments as of analysis date. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning exploitation is straightforward once credentials are obtained. The primary risk scenario involves: (1) devices with default/weak admin credentials exposed to the internet, (2) credential compromise through phishing or credential stuffing, or (3) pivot attacks from already-compromised networks. Risk is substantially mitigated by: strong password policies, network segmentation isolating IoT devices, and disabling remote HNAP access. The DCS-935L is an older consumer IP camera model (firmware 1.10.01 dates to approximately 2015-2017 era), and D-Link has historically provided limited long-term support for end-of-life consumer products-verify current support status before deploying mitigations.

An attacker identifies internet-exposed D-Link DCS-935L cameras through Shodan or Censys searches, targeting devices with HNAP service accessible on port 80 or 443. After obtaining admin credentials via credential stuffing attacks using leaked password databases or exploiting default credentials (if unchanged), the attacker sends a crafted HTTP POST request to /web/cgi-bin/hnap/hnap_service with an oversized AdminPassword parameter exceeding buffer limits (exploit code available at https://github.com/0xcc12138/DCS-935L-HNAP-Service-CVE). The buffer overflow overwrites return addresses or function pointers, redirecting execution to attacker-supplied shellcode that establishes persistent backdoor access, enabling surveillance feed interception, camera repurposing for botnet inclusion, or lateral movement into the victim's network.