A format string bug exists in the snprintf function used by the /web/cgi-bin/greece/rhea HTTP handler of the D-Link DCS‑935L. By manipulating the arguments supplied in HTTP requests, an attacker can cause the firmware to interpret user input as a format string, potentially allowing arbitrary memory read or write. This flaw can lead to remote code execution or privilege escalation if the attacker can control the format string payload.

The affected product is the D-Link DCS‑935L network camera, specifically firmware version 1.10.01. The vulnerability resides in the HTTP handler component that serves the web interface. Only devices running this exact firmware version are vulnerable; newer firmware updates may have fixed the issue.

The CVSS score is 8.7, indicating a high severity vulnerability, and the EPSS score is not available, but the publicly disclosed exploit demonstrates the ability to launch attacks remotely. Because the vulnerable functionality is reachable over the network, devices exposed to the Internet face a high likelihood of exploitation. The flaw is not listed in CISA KEV, but the lack of a patch makes it a significant risk for exposed systems.