Volerion logoVolerion
Volerion logoVolerion

D-Link DCS-932L OS Command Injection Vulnerability

Vulnerability

A critical command injection vulnerability has been identified in the D-Link DCS-932L camera, specifically in version 2.18.01. The issue arises in the 'setSystemAdmin' function, where the 'AdminID' parameter can be manipulated to execute arbitrary operating system commands. This vulnerability can be exploited remotely and affects products that are no longer supported by the manufacturer.

Impact

Exploitation of this vulnerability allows for remote command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the '/setSystemAdmin' endpoint with a crafted 'AdminID' parameter. The payload should include the desired OS command, such as 'telnetd', which will be executed by the device.

Added: Sep 1, 2025, 7:22 PM
Updated: Sep 1, 2025, 7:22 PM

Vulnerability Rating

Custom Algorithm
spread
5.7
impact
10.0
exploitability
6.2
remediation
0.0
relevance
0.0
threat
6.5
urgency
2.9
incentive
0.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.