Executive brief
The D-Link DCS-932L is a network surveillance camera used for security and monitoring. A security flaw in the camera's web management software allows an attacker to take full control of the device by sending a specially crafted request. This could lead to unauthorized access to video feeds, disruption of monitoring services, or the use of the camera as a foothold to attack other devices on the local network.
Technical details
A command injection vulnerability exists in the 'alphapd' binary of the D-Link DCS-932L camera, specifically within the 'sub_42EF14' function. The vulnerability is triggered when the application processes the 'LightSensorControl' parameter at the '/setDayNightStream' endpoint. The software fails to sanitize this user-supplied input before concatenating it into a system command string ('gpio lightcontrol %s &'). An authenticated remote attacker can exploit this to execute arbitrary shell commands with the privileges of the web server. While the advisory mentions authorized access is required, the impact is high as it allows for complete device compromise.
Affected products
- D-Link DCS-932L 2.18.01
Timeline
- 2026-05-11: disclosed: CVE published to NVD dataset