A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature.
The attack may be performed from remote. The exploit has been published and may be used.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
d-link:dcs-930l
References 6
https://github.com/sweethub521/somevul/blob/main/dlink-dcs930l-bootloader-emerg…
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-108971
cna@vuldb.com
https://vuldb.com/submit/999605
cna@vuldb.com
https://vuldb.com/vuln/416789
cna@vuldb.com
https://vuldb.com/vuln/416789/cti
cna@vuldb.com
https://www.dlink.com/
cna@vuldb.com