CVE-2026-2227

MEDIUM

Dlink Dcs-931l Firmware < 1.13.00 - Command Injection

Title source: rule

Description

A vulnerability was found in D-Link DCS-931L up to 1.13.0. Impacted is the function doSystem of the file /setSystemAdmin. Performing a manipulation of the argument AdminID results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

References (6)

[Permissions Required, VDB Entry] https://vuldb.com/?submit.753980

[Exploit, Third Party Advisory] https://github.com/cha0yang1/CVE/blob/main/D-Link%20DCS931L1.md

View Exploit ZIP pw:eip

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.344944

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.344944

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.753450

[Product] https://www.dlink.com/

Scores

CVSS v3 4.7

EPSS 0.0006

EPSS Percentile 19.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Classification

CWE

CWE-74 CWE-77

Status published

Affected Products (1)

dlink/dcs-931l_firmware < 1.13.00

Timeline

Published Feb 09, 2026

Tracked Since Feb 18, 2026