CVE-2026-108971

9.6 CRITICALpublic exploit available

Published 2026-10-13 · Updated 2026-10-14

AI risk analysis

Summary: A cryptographic signature verification flaw in D-Link DCS-930L's Emergency HTTP Recovery Server allows remote attackers to manipulate firmware updates, potentially leading to arbitrary code execution. This critical vulnerability affects the bootloader region and can be exploited without authentication.
Exploitability: The exploit is highly practical with no authentication required, allowing remote attackers to manipulate firmware images through the Emergency HTTP Recovery Server component.
Blast radius: The vulnerability impacts all D-Link DCS-930L cameras running firmware version B1.08B4 or earlier, potentially affecting thousands of devices in enterprise and residential networks.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to firmware version B1.08B5 or later to address this cryptographic signature verification flaw.

rcefirmwareicsremote

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-345, CWE-347

Public exploit & PoC references

https://github.com/sweethub521/somevul/blob/main/dlink-dcs930l-bootloader-emergency-room-flash.md

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.