D-Link DCS-930L vulnerabilities

3 known CVE vulnerabilities in D-Link DCS-930L, translated and rated.

CVE-2026-108971Critical
A flaw has been found in D-Link DCS-930L B1.08B4 affecting the mpfd_decode function in bootloader_region.bin of the Emergency HTTP Recovery Server component. Manipulating the firmware argument leads to improper verification of the cryptographic signature. The attack can be performed remotely and the exploit has been published.
CVE-2025-14225Medium
A vulnerability was determined in D-Link DCS-930L 1.15.04 affecting an unknown part of the file /setSystemAdmin of the alphapd component. Manipulation of the AdminID argument can lead to command injection, and the attack can be executed remotely.
CVE-2016-11021HighActively exploited
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS