CVE-2026-8260
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A vulnerability was found in D-Link DCS-935L up to 1.10.01 in the SetDeviceSettings function of /web/cgi-bin/hnap/hnap_service. Manipulating the AdminPassword argument results in a buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can remotely take control of the camera, change the admin password, or execute arbitrary code, leading to privacy and security breaches.
Recommendation
Immediately update the camera firmware to the latest version or apply a temporary workaround if the vendor has not yet released a patch.
Other vulnerabilities in D-Link DCS-935L
See all- CVE-2026-13545High
A vulnerability was found in D-Link DCS-935L camera firmware version 1.10.01, allowing OS command injection. The issue resides in the sub_400E40 function of the setconf.cgi file, where the UID argument is mishandled by the POST Parameter Handler component. The attack can be launched remotely, and exploit details are publicly available.
- CVE-2026-12174High
A vulnerability in D-Link DCS-935L 1.10.01 affects the snprintf function in the file /web/cgi-bin/greece/rhea of the HTTP Handler component. Manipulation of the data argument leads to a format string vulnerability. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.