Skip to main content

D-Link DCS-935L EUVD-2026-29016

| CVE-2026-8260 HIGH
Classic Buffer Overflow (CWE-120)
2026-05-11 VulDB GHSA-m69q-2cfc-q63c
Buffer Overflow D-Link
7.4
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Updated
May 11, 2026 - 02:27 vuln.today
v2 (cvss_changed)
Re-analysis Queued
May 11, 2026 - 02:22 vuln.today
cvss_changed
CVSS changed
May 11, 2026 - 02:22 NVD
8.8 (HIGH) 7.4 (HIGH)
Analysis Generated
May 11, 2026 - 02:01 vuln.today
CVE Published
May 11, 2026 - 01:15 nvd
HIGH 8.8

DescriptionNVD

A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Buffer overflow in D-Link DCS-935L camera firmware versions up to 1.10.01 allows authenticated remote attackers to achieve complete system compromise via crafted AdminPassword parameter to the HNAP service. Public exploit code exists on GitHub (0xcc12138/DCS-935L-HNAP-Service-CVE), demonstrating weaponization of this vulnerability. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Inventory all D-Link DCS-935L cameras and document firmware versions; restrict network access to these devices to trusted networks only using firewall rules or VLANs. Within 7 days: Change all camera administrative credentials to complex, unique passwords; disable HNAP service if not required for legitimate management. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

More from same product – last 7 days

CVE-2026-4377 MEDIUM
6.0 May 28

Weak default credential generation in the D-Link DWR-X1820 router exposes administrative access to adjacent-network atta

Share

EUVD-2026-29016 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy