EXPOSURES › CVE-2026-108971
CVE-2026-108971
CRITICALD-Link's DCS-930L camera firmware allows remote code execution via improper cryptographic signature verification in the bootloader.
An attacker can remotely manipulate the firmware argument to bypass signature verification in the Emergency HTTP Recovery Server, enabling arbitrary code execution. DIB organizations must ensure all IoT and network hardware is patched, as unpatched vulnerabilities in critical infrastructure devices can lead to supply-chain compromises and unauthorized access to sensitive networks.
Shame score — A critical remote code execution flaw in a widely deployed IoT device was publicly exploited, demonstrating severe negligence in firmware security and signature verification.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.