CVE-2019-10999

The CVE-2019-10999 issue affects D-Link DCS series cameras with the alphapd web server, via a stack-based buffer overflow triggered by a long WEPEncryption value in wireless.htm. Root cause: improper handling in alphapd leading to remote code execution. Affected devices include DCS-5009L, 5010L, ...

CVE-2017-7852

CVE-2017-7852 affects D-Link DCS series cameras (notably DCS-933L, DCS-5030L, DCS-5020L, DCS-2530L, DCS-2630L, DCS-930L, DCS-932L, DCS-932LB1). Root cause: weak CrossDomain.XML with allow-access-from set to * enables Cross-Site Request Forgery (CSRF) via malicious Flash hosted on attacker sites. ...

CVE-2025-5573

The CVE-2025-5573 entry concerns D-Link DCS-932L (firmware 2.18.01) with a flaw in the setSystemWizard/setSystemControl function in /setSystemWizard. Manipulating the AdminID argument leads to an OS command injection, exploitable remotely. Public exploit appears to have been disclosed, and affect...

CVE-2018-18441

CVE-2018-18441 affects D-Link DCS series Wi‑Fi cameras (e.g., DCS-936L, DCS-942L, DCS-8000LH, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5020L, etc.). The vulnerability stems from the /common/info.cgi endpoint being accessible without authentication, allowing remote access ...

CVE-2021-41503

Summary: CVE-2021-41503 affects DCS-5000L v1.05 and DCS-932L v2.17 and older. The vulnerability stems from incorrect access control via the devices command interface, where basic authentication may enable unauthorized LAN-side access to camera configuration. Impact (per sources): someone on the l...

CVE-2025-5571

CVE-2025-5571 affects D-Link DCS-932L (firmware 2.18.01). The vulnerability resides in setSystemAdmin, where manipulating the AdminID parameter enables OS command injection. Exploitation appears remote and the issue is associated with devices no longer supported by the maintainer. Public disclosu...

CVE-2025-4842

CVE-2025-4842 affects D-Link DCS-932L (firmware 2.18.01). The vulnerability lies in the isUCPCameraNameChanged function in /sbin/ucp, where unsafely handling the CameraName parameter causes a stack-based buffer overflow. Reported as remotely exploitable with publicly disclosed exploit; product is...

CVE-2021-41504

CVE-2021-41504 affects D-Link DCS-5000L (v1.05) and DCS-932L (v2.17) and older. The root cause is the use of digest-authentication for the devices command interface, which may enable elevated privileges and allow a malicious LAN user to access or alter the cameras’ configuration. This vulnerabili...

CVE-2025-5572

CVE-2025-5572 concerns the D-Link DCS-932L camera (firmware 2.18.01). The vulnerability lies in the function setSystemEmail in /setSystemEmail, where manipulating the EmailSMTPPortNumber argument causes a stack-based buffer overflow. It is described as remotely exploitable, and the affected devic...

CVE-2024-37606

CVE-2024-37606 affects D-Link DCS-932L REVB firmware (2.18.01). The vulnerability is a stack/buffer overflow in the alphapd component that can be triggered by a crafted HTTP request, leading to Denial of Service. The issue is documented across multiple sources (NVD/NVD-derived listings, CNVD, Red...

CVE-2012-4046

The CVE-2012-4046 issue affects the D-Link DCS-932L IP camera (firmware 1.02). A UDP broadcast handling error allows remote attackers in the same network to obtain the camera password (demonstrated via reading the _paramR["P"] value during setup). The provided documents do not consistently state ...

CVE-2025-4843

CVE-2025-4843 affects D-Link DCS-932L (firmware 2.18.01) via SubUPnPCSInit in /sbin/udev. The CameraName argument is not properly validated, causing a stack-based buffer overflow that enables remote code execution. Exploitation is publicly disclosed and applies to devices no longer supported by t...

CVE-2025-4841

This CVE affects D-Link DCS-932L firmware 2.18.01. The vulnerability is a stack-based buffer overflow in /bin/gpio at sub_404780 triggered by manipulating the CameraName argument, allowing remote exploitation. Multiple sources confirm the issue and note the product is no longer supported; no offi...

CVE-2026-36983

D-Link DCS-932L v2.18.01 is affected by a Command Injection in the helper function sub_42EF14 of /bin/alphapd. Passing/manipulating the LightSensorControl argument can lead to command execution. CVSSv3.1 base score 7.3 (HIGH); attack vector NETWORK, attack complexity LOW, privileges NONE, user in...