CVE-2026-108971
CriticalCVSS 9.6Summary
A flaw has been found in D-Link DCS-930L B1.08B4 affecting the mpfd_decode function in bootloader_region.bin of the Emergency HTTP Recovery Server component. Manipulating the firmware argument leads to improper verification of the cryptographic signature. The attack can be performed remotely and the exploit has been published.
Risk Assessment
Improper cryptographic signature verification may allow an attacker to upload modified firmware, leading to full device compromise. Since the exploit is publicly available, the risk of exploitation is high.
Recommendation
Update the D-Link DCS-930L firmware to the latest version if the vendor provides a fix, or isolate the device from untrusted network access. Consider retiring the device if vendor support has ended.
Other vulnerabilities in D-Link DCS-930L
See all- CVE-2025-14225Medium
A vulnerability was determined in D-Link DCS-930L 1.15.04 affecting an unknown part of the file /setSystemAdmin of the alphapd component. Manipulation of the AdminID argument can lead to command injection, and the attack can be executed remotely.
- CVE-2016-11021HighActively exploited
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
Original NVD description (English source)
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS