The flaw resides in the sub_42EF14 function of the /bin/alphapd binary in D‑Link DCS‑932L firmware 2.18.01 and is triggered by manipulating the LightSensorControl argument. By sending a crafted value, an attacker can inject and execute shell commands on the device. This gives the attacker full control, compromising confidentiality, integrity, and availability of the device and potentially the network segment it sits on. The vulnerability is a classic example of CWE‑77: Command Injection, which typically does not require local compromise and is particularly dangerous when exposed to the internet.

D‑Link DCS‑932L devices running firmware version 2.18.01 are affected. No other versions or firmware variants are listed.

A CVSS score of 7.3 is provided and the EPSS score of < 1% indicates a very low, but nonzero, probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the direct remote nature of the flaw means that any device within network reach can be attacked by sending a specially crafted LightSensorControl request. The lack of disclosure of mitigation measures in public sources suggests that exploitation is straightforward if network access exists. The risk remains high due to the potential for complete compromise, even though the overall probability of exploitation is low.