A buffer overflow flaw in the SetDeviceSettings function of the HNAP Service on D-Link DCS‑935L devices occurs when the AdminPassword argument is crafted to overflow an internal buffer. The flaw can be triggered remotely, allowing an attacker to execute arbitrary code or take control of the device. The vulnerability is enumerated as CWE‑119 (Buffer Overflow) and CWE‑120 (Stack‑based Buffer Overflow).

The flaw affects all D-Link DCS‑935L cameras whose firmware version is 1.10.01 or earlier. No other product models or firmware revisions are listed as vulnerable.

The CVSS score of 8.7 places the issue in the high severity range. No EPSS value is reported, and it is not catalogued in the CISA KEV list, but the public exploit demonstrates that remote attackers can leverage the overflow without authentication. Because it is a remote, unauthenticated vulnerability that triggers code execution, the risk to compromised premises is significant, especially in unprotected or exposed deployments.