Which versions of D-Link DCS-935L are affected by EUVD-2026-29016?

D-Link DCS-935L network cameras running firmware versions up to 1.10.01 contain a buffer overflow vulnerability in the HNAP service that allows authenticated attackers to achieve complete system…

Is there a public PoC exploit available for EUVD-2026-29016?

Yes, a public proof-of-concept exploit is available for EUVD-2026-29016. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-29016?

Within 24 hours: Inventory all D-Link DCS-935L cameras and document firmware versions; restrict network access to these devices to trusted networks only using firewall rules or VLANs. Within 7 days: Change all camera administrative credentials to complex, unique passwords; disable HNAP service if not required for legitimate management. Within 30 days: Contact D-Link support for firmware updates beyond 1.10.01; evaluate replacement with devices from vendors providing active security maintenance.

D-Link DCS-935L EUVD-2026-29016

Q: What is the CVSS score of EUVD-2026-29016?

EUVD-2026-29016 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8260 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-11 VulDB

GHSA-m69q-2cfc-q63c

D-Link Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 11, 2026 - 02:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 11, 2026 - 02:22 vuln.today

cvss_changed

CVSS changed

May 11, 2026 - 02:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 11, 2026 - 02:01 vuln.today

CVE Published

May 11, 2026 - 01:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Buffer overflow in D-Link DCS-935L camera firmware versions up to 1.10.01 allows authenticated remote attackers to achieve complete system compromise via crafted AdminPassword parameter to the HNAP service. Public exploit code exists on GitHub (0xcc12138/DCS-935L-HNAP-Service-CVE), demonstrating weaponization of this vulnerability. CVSS 4.0 score of 7.4 with CVSS:4.0/E:P confirms proof-of-concept exploitation. While authentication is required (PR:L), the low attack complexity (AC:L) and network attack vector (AV:N) combined with publicly available exploit code make this a practical remote exploitation risk for devices exposed to untrusted networks or compromised accounts.

Technical ContextAI

This vulnerability affects the HNAP (Home Network Administration Protocol) service implementation in D-Link DCS-935L IP cameras. HNAP is a proprietary network management protocol used by consumer routers and IoT devices for remote administration. The vulnerable function SetDeviceSettings in /web/cgi-bin/hnap/hnap_service fails to properly validate the length of the AdminPassword parameter before copying it to a fixed-size buffer. This is a classic stack-based or heap-based buffer overflow (CWE-120), where attacker-controlled input exceeds allocated memory boundaries. The CPE identifier cpe:2.3:a:d-link:dcs-935l:*:*:*:*:*:*:*:* confirms this affects the application firmware component. HNAP services typically run with elevated privileges to perform administrative functions, making successful exploitation particularly severe. The CVSS vector indicates complete confidentiality, integrity, and availability impact on the vulnerable component (VC:H/VI:H/VA:H) with no impact beyond the vulnerable component (SC:N/SI:N/SA:N).

RemediationAI

Check D-Link support portal (https://www.dlink.com/) for firmware updates addressing CVE-2026-8260 for DCS-935L models. As of analysis date, no specific patched firmware version has been independently confirmed in available data sources-vendor advisory review required. If no patch is available or device is end-of-life: (1) Disable remote HNAP service access entirely if camera management can be performed locally or via VPN-verify impact on cloud features and mobile app functionality before deployment. (2) Implement strong, unique administrative passwords (16+ characters, random generation) to raise credential compromise difficulty. (3) Place cameras on isolated VLAN with firewall rules blocking inbound internet access to TCP ports 80, 443, 8080, and HNAP-specific ports (typically 80/443)-this prevents remote exploitation but may disable cloud recording and remote viewing features. (4) Deploy intrusion detection signatures monitoring for HNAP service buffer overflow attempts targeting /web/cgi-bin/hnap/hnap_service with oversized AdminPassword parameters. (5) Consider hardware replacement with actively supported models if device has reached end-of-support status. Workarounds involve functionality trade-offs: disabling remote access eliminates remote monitoring convenience that is the primary product value proposition.