Actively exploited in the wild
D-Link DCS-930L Devices OS Command Injection Vulnerability
D-Link - DCS-930L Devices · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2016-11021
HighCVSS 7.2KEVSummary
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
Risk Assessment
The risk for the organization is the possibility of remote code execution on vulnerable cameras, potentially leading to privacy breaches and use of the device for further attacks.
Recommendation
It is recommended to update the firmware of D-Link DCS-930L cameras to version 2.12 or later and restrict access to the devices from external networks.
Other vulnerabilities in D-Link DCS-930L
See all- CVE-2026-108971Critical
A flaw has been found in D-Link DCS-930L B1.08B4 affecting the mpfd_decode function in bootloader_region.bin of the Emergency HTTP Recovery Server component. Manipulating the firmware argument leads to improper verification of the cryptographic signature. The attack can be performed remotely and the exploit has been published.
- CVE-2025-14225Medium
A vulnerability was determined in D-Link DCS-930L 1.15.04 affecting an unknown part of the file /setSystemAdmin of the alphapd component. Manipulation of the AdminID argument can lead to command injection, and the attack can be executed remotely.
Original NVD description (English source)
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS