CVE-2026-108971
Received Received - Intake

Improper Cryptographic Signature Verification in D-Link DCS-930L B1.08B4

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108971
EUVD
EUVD-2026-98294

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
D-Link DCS-930L B1.08B4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the D-Link DCS-930L Network Camera (firmware version B1.08B4). It allows unauthenticated firmware flashing through the bootloader's emergency recovery mode. The bootloader enters recovery mode when the reset button is held during power-on, starts an HTTP server on port 80, and accepts a firmware file via a multipart/form-data POST request. The flaw is in the bootloader's validation process, which only checks for a uImage magic value and basic header consistency without verifying cryptographic signatures. This enables attackers to upload and execute arbitrary code by crafting a malicious uImage file.

Detection Guidance

Check if your D-Link DCS-930L camera is running firmware version B1.08B4. Monitor network traffic for unexpected HTTP POST requests to port 80, especially from unknown sources. Look for signs of unauthorized firmware flashing or unusual bootloader behavior during startup.

Impact Analysis

An attacker could exploit this to gain full control over the affected D-Link camera. This includes installing malware, monitoring video feeds, or using the device as a pivot point to attack other systems on the network. The attack can be performed remotely without authentication, making it particularly dangerous for unpatched devices.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data captured by the camera, violating privacy regulations like GDPR or HIPAA. Organizations using unpatched devices may face compliance breaches, legal penalties, and reputational damage due to potential data exposure or unauthorized surveillance.

Mitigation Strategies

Disable the Emergency HTTP Recovery Server by not holding the reset button during power-on. Update the camera firmware to the latest version if available. Block external access to port 80 on the camera's network interface. Monitor for any signs of compromise or unauthorized firmware changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart