Vulnerability details
CVE-2026-108971
D-Link DCS-930L
D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
CVSS 4.0
9.4Critical
Official description
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P |
| 9.6Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R |
| 9.6Critical | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R |
| 10.0High | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| D-Link | DCS-930L | B1.08B4 | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://vuldb.com/vuln/416789 vdb-entrytechnical-description
- https://vuldb.com/vuln/416789/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-108971 third-party-advisory
- https://vuldb.com/submit/999605 third-party-advisory
- https://github.com/sweethub521/somevul/blob/main/dlink-dcs930l-bootloader-emergency-room-flash.md exploit
- https://www.dlink.com/ product
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-13
- Last updated
- 2026-10-14
- State
- Published
- Assigner (CNA)
- VulDB
- Kolun priority
- 33 · Low
Exploit prediction (EPSS)
0.22%
Probability of exploitation in 30 days
13.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-347Improper Verification of Cryptographic Signature
- CWE-345Insufficient Verification of Data Authenticity