CVE-2019-10999

HIGH

D-Link DCS Series Firmware - Authenticated Stack-based Buffer Overflow via WEPEncryption Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2019-10999. PoCs published by tacnetsol, qjh2333.

AI-analyzed exploit summary This repository contains functional exploit code for CVE-2019-10999, targeting multiple D-Link camera models (DCS-5020L, DCS-930L, etc.) via buffer overflow and ROP chain techniques. The code includes device-specific payloads and ROP gadgets for achieving remote code execution.

Description

The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a remotely authenticated attacker to execute arbitrary code by providing a long string in the WEPEncryption parameter when requesting wireless.htm. Vulnerable devices include DCS-5009L (1.08.11 and below), DCS-5010L (1.14.09 and below), DCS-5020L (1.15.12 and below), DCS-5025L (1.03.07 and below), DCS-5030L (1.04.10 and below), DCS-930L (2.16.01 and below), DCS-931L (1.14.11 and below), DCS-932L (2.17.01 and below), DCS-933L (1.14.11 and below), and DCS-934L (1.05.04 and below).

Exploits (3)

nomisec WORKING POC 43 stars
by tacnetsol · poc
https://github.com/tacnetsol/CVE-2019-10999

This repository contains functional exploit code for CVE-2019-10999, targeting multiple D-Link camera models (DCS-5020L, DCS-930L, etc.) via buffer overflow and ROP chain techniques. The code includes device-specific payloads and ROP gadgets for achieving remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: D-Link DCS-5020L, DCS-930L, DCS-930LB1, DCS-932L, DCS-932LB1
No auth needed
Prerequisites: Network access to vulnerable D-Link camera · Knowledge of target firmware version
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec STUB
by qjh2333 · poc
https://github.com/qjh2333/CVE-2019-10999

The repository contains only a README.md with a title and no functional exploit code or technical details. It is a placeholder with minimal content.

Classification
Stub 100%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 19, 2026 Full analysis →
inthewild WORKING POC
poc
https://github.com/fuzzywalls/cve-2019-10999

This repository contains functional exploit code for CVE-2019-10999, targeting multiple D-Link camera models (DCS-5020L, DCS-930L, DCS-930LB1, DCS-932L, DCS-932LB1). The exploit leverages buffer overflows and ROP gadgets to achieve remote code execution by manipulating stack-based overflows in the alphapd binary.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: D-Link DCS-5020L, DCS-930L, DCS-930LB1, DCS-932L, DCS-932LB1 (various firmware versions)
No auth needed
Prerequisites: Network access to vulnerable D-Link camera · Knowledge of target firmware version for ROP gadget selection
devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/fuzzywalls/CVE-2019-10999

Scores

CVSS v3 8.8
EPSS 0.3580
EPSS Percentile 97.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (10)
dlink/dcs-5009l_firmware < 1.08.11
dlink/dcs-5010l_firmware < 1.14.09
dlink/dcs-5020l_firmware < 1.15.12
dlink/dcs-5025l_firmware < 1.03.07
dlink/dcs-5030l_firmware < 1.04.10
dlink/dcs-930l_firmware < 2.16.01
dlink/dcs-931l_firmware < 1.14.11
dlink/dcs-932l_firmware < 2.17.01
dlink/dcs-933l_firmware < 1.14.11
dlink/dcs-934l_firmware < 1.05.04
Published May 06, 2019
Tracked Since Feb 18, 2026