PT-2026-7070 · D Link · D-Link Dcs-933L

Allanp0E · Publicado 2026-02-09 · Atualizado 2026-02-09 · CVE-2026-2218

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DCS-933L versions up to 1.14.11

Description A flaw exists in D-Link DCS-933L that allows for command injection. This issue stems from manipulating the AdminID argument within an unknown function of the /setSystemAdmin file, part of the alphapd component. Successful exploitation enables remote attackers to execute commands on the system. The exploit is publicly available. This vulnerability impacts products no longer supported by the maintainer.

Recommendations Versions prior to 1.14.11 should not be used.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2026-2218

Produtos afetados

D-Link Dcs-933L

Referências · 10

• 🔥 https://github.com/jinhao118/cve/blob/main/D-Link%20DCS933L_v1.14.11.md#poc · Exploit
• 🔥 https://github.com/jinhao118/cve/blob/main/D-Link%20DCS933L_v1.14.11.md · Exploit
• https://t.me/CVEtracker/44176 · Publicação no Telegram
• https://vuldb.com/?ctiid.344936 · Nota
• https://vuldb.com/?id.344936 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2218 · Nota de Segurança
• https://dlink.com · Nota
• https://t.me/cveNotify/151366 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-2218 · Aviso do Fabricante
• https://vuldb.com/?submit.753247 · Nota