Is CVE-2026-108971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108971 being exploited in the wild.

How severe is CVE-2026-108971?

Critical severity, with a CVSS score of 9.6, published 13 October 2026.

Which products and versions are affected?

D-Link DCS-930L B1.08B4 (firmware 1.08).

Is there a fix for CVE-2026-108971?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108971 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-108971?

Check whether you run D-Link DCS-930L at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108971: D-Link DCS-930L bootloader Emergency Room improper signature verification

CVE-2026-108971 · Severity: critical · CVSS 9.6 · Published 2026-10-13

The D-Link DCS-930L network camera's bootloader contains an "Emergency Room" HTTP recovery server that accepts firmware uploads with only minimal validation. An unauthenticated attacker with network access can upload a malicious firmware image by holding the reset button during power-on to trigger recovery mode; the bootloader verifies only the uImage magic number and header consistency without any cryptographic signature check. This allows arbitrary code execution with device privileges, potentially giving an attacker complete control over the camera.

Vendors: D-Link.

Quick answers

Is CVE-2026-108971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108971 being exploited in the wild.
How severe is CVE-2026-108971?: Critical severity, with a CVSS score of 9.6, published 13 October 2026.
Which products and versions are affected?: D-Link DCS-930L B1.08B4 (firmware 1.08).
Is there a fix for CVE-2026-108971?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108971 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-108971?: Check whether you run D-Link DCS-930L at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The bootloader's mpfd_decode function in bootloader_region.bin (file offset 0x8001A03C) parses multipart/form-data firmware uploads in Emergency Room recovery mode. The validator at 0x80019448–0x80019700 performs only five format checks (uImage magic 0x27051956, header consistency, data size, image type) with no RSA, HMAC, SHA, or MD5 verification present. A direct control-flow branch at 0x80019684 transfers from the validator to the flash writer with no intervening privilege check, allowing any well-formed uImage header to pass validation regardless of payload content and be written to the kernel partition at flash offset 0x50000.

Affected products

D-Link DCS-930L B1.08B4 (firmware 1.08)

Timeline

2026-10-13: disclosed
exploited: exploit code published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.