CVE-2026-12174
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in D-Link DCS-935L 1.10.01 affects the snprintf function in the file /web/cgi-bin/greece/rhea of the HTTP Handler component. Manipulation of the data argument leads to a format string vulnerability. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk includes remote code execution or information disclosure, potentially compromising system confidentiality and integrity.
Recommendation
Immediately update the D-Link DCS-935L firmware to the latest version or disconnect the device from the network until a patch is available.
Other vulnerabilities in D-Link DCS-935L
See all- CVE-2026-13545High
A vulnerability was found in D-Link DCS-935L camera firmware version 1.10.01, allowing OS command injection. The issue resides in the sub_400E40 function of the setconf.cgi file, where the UID argument is mishandled by the POST Parameter Handler component. The attack can be launched remotely, and exploit details are publicly available.
- CVE-2026-8260High
A vulnerability was found in D-Link DCS-935L up to 1.10.01 in the SetDeviceSettings function of /web/cgi-bin/hnap/hnap_service. Manipulating the AdminPassword argument results in a buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.