CVE-2026-11497
Received Received - Intake
Least Privilege Violation in D-Link DCS-5615 Boa Webserver

Publication date: 2026-06-08

Last updated on: 2026-06-08

Assigner: VulDB

Description
A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of the component Boa Webserver. Such manipulation leads to least privilege violation. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-08
Last Modified
2026-06-08
Generated
2026-06-08
AI Q&A
2026-06-08
EPSS Evaluated
N/A
NVD
CVE-2026-11497
EUVD
EUVD-2026-35027
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
d-link dcs-5615 1.01.00
boa boa *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-272 The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Boa Webserver component of the D-Link DCS-5615 device, specifically related to the file /etc/conf.d/boa/boa.conf. It allows an attacker to remotely manipulate an unknown functionality, resulting in a least privilege violation.

Impact Analysis

The vulnerability can be exploited remotely to violate least privilege restrictions, potentially allowing an attacker to perform actions or access resources beyond their intended permissions. This could lead to unauthorized manipulation or control within the affected system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart