Buffer overflow in D-Link Dcs-935l
CVE-2026-12174
A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Vulnerability class: Buffer Overflow
EPSS: 0.006 (45.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- D-link Dcs-935l — versions 1.10.01
- Dlink Dcs-935l
- Dlink Dcs-935l_firmware — versions 1.10.01
Weakness classification (CWE)
References
- cna@vuldb.com (Third Party Advisory, exploit)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (Product, product)
Frequently asked questions
- What is CVE-2026-12174?
- CVE-2026-12174 is a high-severity vulnerability in D-Link Dcs-935l, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2026-06-13.
- How severe is CVE-2026-12174?
- High severity. CVSS v3 base score is 8.8 out of 10.