Description
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
Published: 2026-10-13
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution via unauthorized firmware installation due to signature verification bypass
Action: Immediate Patch
AI Analysis

Impact

A flaw in the mpfd_decode function of the Emergency HTTP Recovery Server's bootloader_region.bin allows an attacker to manipulate the firmware argument and bypass cryptographic signature checks. This flaw can enable the unauthorized flashing of firmware onto the device, effectively allowing remote code execution or device takeover. The vulnerability is a signature verification error, which undermines the integrity guarantees of the recovery process.

Affected Systems

The vulnerability affects D-Link DCS-930L devices running firmware version B1.08B4. No other vendors or product versions are currently identified as impacted.

Risk and Exploitability

The CVSS score is 9.4, indicating a high to critical severity. The exploit is published and demonstrated, and the attack vector is remote via the Emergency HTTP Recovery Server. Although the EPSS score is not available, the public availability of the exploit raises the likelihood of exploitation. The vulnerability is not listed in CISA KEV, but the existence of a working exploit and the ability to execute it remotely make it a significant operational risk.

Generated by OpenCVE AI on October 13, 2026 at 07:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor's firmware update that fixes the mpfd_decode signature verification logic for the DCS-930L.
  • If the Emergency HTTP Recovery Server is not required, disable or unplug the associated port to eliminate the attack surface.
  • Restrict network access to the HTTP recovery interface to trusted IP addresses or isolate it behind a firewall to prevent unauthorized connections.

Generated by OpenCVE AI on October 13, 2026 at 07:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
Title D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
First Time appeared D-link
D-link dcs-930l
Weaknesses CWE-345
CWE-347
CPEs cpe:2.3:h:d-link:dcs-930l:*:*:*:*:*:*:*:*
Vendors & Products D-link
D-link dcs-930l
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

D-link Dcs-930l
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T05:45:16.733Z

Reserved: 2026-10-11T19:47:42.722Z

Link: CVE-2026-108971

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T06:16:50.090

Modified: 2026-10-13T06:16:50.090

Link: CVE-2026-108971

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:30:15Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

  • CWE-347

    Improper Verification of Cryptographic Signature