Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-9517: D-Link DCS-2103 camera firmware lets attackers run scripts

CVE-2014-9517 · published 11 years ago

Summary

The camera’s web interface can be tricked into running code that an attacker supplies. This could let someone display fake pages or steal information from anyone viewing the camera’s setup page. Updating the camera to the latest firmware version fixes the problem.

What to do

Update dlink dcs-2103_firmware to version 1.20 or later.

Affected software

Vendor	Product	Affected versions
dlink	dcs-2103_firmware	< 1.20 `cpe:2.3:o:dlink:dcs-2103_firmware::::::::`

Original advisory text

Cross-site scripting (XSS) vulnerability in D-link IP camera DCS-2103 with firmware before 1.20 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to vb.htm.

References

http://packetstormsecurity.com/files/129609/D-Link-DCS-2103-Brute-Force-Cross-Si... Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2014/Dec/85 Mailing List Third Party Advisory
http://websecurity.com.ua/7288/ Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published5 Jan 2015

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2014-9517 · NVD

Track software like this

Free during beta