Least Privilege Violation in D-Link DCS-5615 Boa Webserver

Publication date: 2026-06-08

Last updated on: 2026-06-09

Assigner: VulDB

Description

A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of the component Boa Webserver. Such manipulation leads to least privilege violation. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-08

Last Modified

2026-06-09

Generated

2026-06-29

AI Q&A

2026-06-08

EPSS Evaluated

2026-06-27

NVD

CVE-2026-11497

EUVD

EUVD-2026-35027

Affected Vendors & Products

Vendor	Product	Version / Range
dlink	dcs-5615_firmware	1.01.00

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-272	The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Boa Webserver component of the D-Link DCS-5615 device, specifically related to the file /etc/conf.d/boa/boa.conf. It allows an attacker to remotely manipulate an unknown functionality, resulting in a least privilege violation.

Impact Analysis

The vulnerability can be exploited remotely to violate least privilege restrictions, potentially allowing an attacker to perform actions or access resources beyond their intended permissions. This could lead to unauthorized manipulation or control within the affected system.

Hi! I’m here to help you understand CVE-2026-11497. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70