PT-2026-39536 · D Link · Dcs-935L

0Xcc12138 · Published 2026-05-10 · Updated 2026-05-12 · CVE-2026-8260

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-935L versions prior to 1.10.01

Description A remote buffer overflow exists in the HNAP Service component within the '/web/cgi-bin/hnap/hnap service' file. The issue occurs during the processing of the SetDeviceSettings() function when the AdminPassword argument is manipulated. This flaw allows attackers to execute arbitrary code remotely.

Recommendations Update to a version later than 1.10.01. As a temporary workaround, disable the HNAP Service to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2026-06625

CVE-2026-8260

Affected Products

Dcs-935L

References · 16

• 🔥 https://github.com/0xcc12138/DCS-935L-HNAP-Service-CVE · Exploit
• https://bdu.fstec.ru/vul/2026-06625 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-8260 · Security Note
• https://t.me/cveNotify/163283 · Telegram Post
• https://twitter.com/0x2ed3bb60/status/2053669842599993725 · Twitter Post
• https://vuldb.com/vuln/362557 · Note
• https://dlink.com · Note
• https://t.me/cveNotify/162982 · Telegram Post
• https://vuldb.com/vuln/362557/cti · Note
• https://vuldb.com/submit/809888 · Note
• https://t.me/CVEtracker/53336 · Telegram Post
• https://twitter.com/vuldb/status/2053497595142775082 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1ta311v/critical_buffer_overflow_vulnerability_found_in · Reddit Post
• https://t.me/CSIRT_italia/3484 · Telegram Post
• https://twitter.com/NewsNerdie/status/2053898582789382587 · Twitter Post