The vulnerability resides in the sub_42EF14 function of the /bin/alphapd binary in D‑Link DCS‑932L firmware 2.18.01. Manipulating the LightSensorControl argument can cause a command injection, allowing an attacker to execute arbitrary shell commands on the device. Based on the description, it is inferred that this injection could provide the attacker with full control over the device, potentially compromising confidentiality, integrity, and availability.

D‑Link DCS‑932L devices running firmware version 2.18.01 are affected. No other firmware versions or variants are explicitly listed.

The CVSS score is 7.3, indicating high severity. The EPSS score of 6% indicates a low to moderate likelihood of exploitation. The vulnerability is not listed in CISA KEV. The flaw can be triggered by sending a crafted request that manipulates the LightSensorControl argument. Based on the description, it is inferred that the attack vector is remote, as the parameter can be altered over the network, and that no local privilege escalation is required to exploit the flaw.