Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

D-Link DCS-2121 camera lets remote attacker run commands via password

CVE-2010-4964 · published 15 years ago
Summary

The D-Link DCS-2121 camera running firmware version 1.04 accepts a specially crafted password that includes shell characters, allowing an external user to execute commands on the device. This could let an attacker gain control of the camera and the network it is on. Install the latest firmware update from D-Link and limit camera access to trusted networks to mitigate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dlink dcs-2121_firmware 1.04
cpe:2.3:a:dlink:dcs-2121_firmware:1.04:*:*:*:*:*:*:*
dlink dcs-2121 All versions
cpe:2.3:h:dlink:dcs-2121:*:*:*:*:*:*:*:*
Original advisory text
recorder_test.cgi on the D-Link DCS-2121 camera with firmware 1.04 allows remote attackers to execute arbitrary commands via shell metacharacters in the Password field, related to a "semicolon inje...
recorder_test.cgi on the D-Link DCS-2121 camera with firmware 1.04 allows remote attackers to execute arbitrary commands via shell metacharacters in the Password field, related to a "semicolon injection" vulnerability.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.0 Critical
Exploitation
4% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published16 Oct 2011
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2010-4964 · NVD
Track software like this
Free during beta