EUVD-2026-98294
GHSA-5vhf-mw8w-298v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach emergency recovery HTTP server
-
DeliverySubmit manipulated firmware image
-
ExploitBypass cryptographic signature check in mpfd_decode
-
ExecutionFlash unsigned malicious firmware
-
ImpactFull persistent device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires reaching the device's Emergency HTTP Recovery Server, which on the DCS-930L is normally active only when the camera is in firmware recovery/bootloader mode - not a default running state - so an attacker generally needs the device in (or forced into) recovery mode and network-reachable. Given that access, no authentication is indicated (PR:N) but the CVSS 4.0 vector specifies passive user interaction (UI:P), so some operator/user action in the recovery flow is expected. The limiting factors are therefore the non-default recovery-mode exposure and the passive-interaction requirement; the enabling condition is that mpfd_decode fails to properly verify the firmware image's cryptographic signature, allowing an attacker-supplied 'firmware' argument to be accepted and flashed. |
| Impact | The input assigns a critical CVSS 4.0 base score of 9.4 (AV:N/AC:L/AT:N/PR:N/UI:P), with E:P indicating only Proof-of-Concept exploit maturity - consistent with the POC flag but NOT with active exploitation. This CVE is NOT in CISA KEV and no EPSS probability was provided, so there is no evidence of widespread or automated exploitation; publicly available exploit code exists but POC availability is distinct from in-the-wild use. The high score is driven by the full-compromise impact of an improper firmware signature check (CWE-347), but two factors temper real-world priority: (1) the vulnerable component is the 'Emergency HTTP Recovery Server', which on D-Link cameras is typically reachable only when the device is placed into firmware recovery/bootloader mode - a non-default operational state the input does not confirm is always network-exposed; and (2) UI:P signals a passive-interaction requirement. The vector's PR:N supports an unauthenticated characterization, but the scope-change claims (SC:H/SI:H/SA:H) appear to over-count what is really single-device full compromise rather than impact on a separate system - verify against vendor data, which is absent here. Net: a genuinely severe integrity flaw if the recovery server is reachable, but likely opportunistic/targeted rather than mass-exploitable, and constrained to a legacy consumer camera. |
| Exploit ScenarioDerived | With the DCS-930L in its emergency firmware-recovery mode, a remote attacker on the same network reaches the Emergency HTTP Recovery Server and submits a manipulated 'firmware' argument that the mpfd_decode routine fails to properly signature-verify, allowing an unsigned/malicious firmware image to be flashed. This grants the attacker persistent, full control of the camera. A public proof-of-concept exploit has been published on GitHub (sweethub521/somevul). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Improper verification of a cryptographic firmware signature in the D-Link DCS-930L (firmware B1.08B4) allows a remote attacker to supply a crafted firmware image that the device accepts and flashes, undermining the integrity of the bootloader recovery process. The flaw resides in the mpfd_decode function within bootloader_region.bin, part of the device's Emergency HTTP Recovery Server, which is normally reachable only when the camera is in firmware recovery/bootloader mode rather than in its default running state; exploitation therefore generally requires the device to be in (or forced into) recovery mode and network-reachable, plus the passive user interaction (UI:P) specified by the CVSS 4.0 vector. Publicly available exploit code exists and the input assigns a critical CVSS 4.0 base score of 9.4, but there is no confirmed active exploitation (not listed in CISA KEV) and the E:P metric indicates only Proof-of-Concept maturity.
RemediationAI
No vendor-released patch version is identified in the available data, so remediation should begin by checking D-Link's official support and security pages (https://www.dlink.com/, plus the VulDB advisory at https://vuldb.com/vuln/416789) for a firmware update for the DCS-930L and applying the newest build available; because the device is an end-of-life-era camera, a replacement or network-isolation decision may be warranted if no fix ships. Until a fix is confirmed, the most effective compensating control is to prevent anyone from reaching the Emergency HTTP Recovery Server: keep the camera on an isolated VLAN or management-only segment, block inbound access to its HTTP/recovery ports from untrusted networks and the internet (no port forwarding, no UPnP/NAT-PMP exposure), and restrict administrative access to a trusted host list. Avoid leaving the camera in firmware recovery/bootloader mode, since that is the state in which the vulnerable service is exposed - a reboot back into normal operation removes the attack surface, at the cost of temporarily unavailable recovery functionality. Additional hardening includes disabling UPnP and any cloud/remote-access features that could re-expose the device, and monitoring for unexpected reboots or configuration resets that might indicate a firmware flash attempt. Note that these are mitigations, not fixes: while the signature-verification flaw in mpfd_decode remains unpatched, a network-positioned attacker who reaches the recovery interface can still flash an attacker-controlled image.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-347 improper verification of cryptographic signature issue affecting D-Link DCS-930L firmware B1.08B4 (CPE cpe:2.3:a:d-link:dcs-930l:*:*:*:*:*:*:*:*). The affected code is the mpfd_decode routine stored in bootloader_region.bin, a component of the Emergency HTTP Recovery Server that the bootloader exposes for firmware recovery. Because the signature check on a supplied firmware image is not performed correctly, an attacker who can reach that recovery service can manipulate the 'firmware' argument and have a malicious or modified image accepted as legitimate, defeating the authenticity guarantee that signed firmware is meant to provide. The root cause class (signature verification failure) is significant because the recovery path is exactly the code-last line of defense on embedded devices: once an unsigned image can be flashed, all downstream trust assumptions (boot chain, update validation) are bypassed. Reliability is not absolute - per the independent assessment, exploitation depends on the recovery server being exposed and reachable, with a passive-interaction step in the recovery flow, which is why the vendor-independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) rates attack complexity higher than the 9.4 CVSS 4.0 base score reported in the source data.
Know when Dcs 930L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Recovery server reachable only in non-default recovery mode raises AC:H; no auth gives PR:N; passive operator action is UI:R; unsigned-firmware flash fully compromises the device beyond the bootloader component (S:C, C/I/A:H).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
Technical POC Analysis
Note on evidence: the supplied artifact is labelled "PATCHED SOURCE" but contains no patch diff, no fixed version, and no commit.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
D-Link DCS-930L cameras running firmware B1.08B4 are affected by a critical firmware signature verification flaw (CVE-2026-108971) that could allow an attacker to install malicious firmware when the device is in recovery mode. Publicly available exploit code exists, and a successful attack would compromise device integrity and could provide persistent network access. Organizations using these cameras should prioritize mitigation, especially if devices are internet-facing or on unsegmented networks.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating affected D-Link DCS-930L cameras on a dedicated network segment, blocking inbound access to the Emergency HTTP Recovery Server (typically port 80) from untrusted networks, ensuring devices are not left in recovery mode, and monitoring for unauthorized firmware changes or device reboots. Consider replacing end-of-life devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB