Executive brief
A security vulnerability exists in the D-Link DCS-935L, a popular Wi-Fi camera used for home and business monitoring. An attacker can exploit a flaw in the device's management service to gain full control over the camera. This could lead to unauthorized access to video feeds, disruption of surveillance operations, or the device being used as a foothold to attack other systems on the local network.
Technical details
A stack-based buffer overflow vulnerability exists in the HNAP Service component of D-Link DCS-935L firmware (versions <= 1.10.01). The flaw is located in the SetDeviceSettings function within /web/cgi-bin/hnap/hnap_service. Specifically, the AESDecrypt function calls a conversion sub-function (sub_41B20C) that lacks length validation when processing the AdminPassword XML node. By sending a specially crafted, excessively long hexadecimal string in an XML request, a remote authenticated attacker can overflow a fixed-size stack buffer. This can lead to arbitrary remote code execution (RCE) with the privileges of the service. Public exploit code is available.
Affected products
- D-Link DCS-935L Firmware up to 1.10.01
Timeline
- 2026-05-11: advisory: Initial disclosure by VulDB/NVD
- 2026-05-11: other: Public exploit code released on GitHub