Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-108971: D-Link DCS-930L can be tricked into accepting fake firmware
CVE-2026-108971 · published 3 days ago
Summary
The D-Link DCS-930L camera’s emergency recovery feature can be fooled into accepting altered firmware because it does not correctly check the digital signature. An attacker on the network could exploit this to install malicious code on the device. Apply the latest firmware update from D-Link or disable the emergency HTTP recovery function if it is not needed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| d-link | dcs-930l | B1.08B4 |
Original advisory text
D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-347Improper Verification of Cryptographic Signature
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta