PT-2026-7070 · D Link · D-Link Dcs-933L

Allanp0E · Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-2218

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DCS-933L versions up to 1.14.11

Description A flaw exists in D-Link DCS-933L that allows for command injection. This issue stems from manipulating the AdminID argument within an unknown function of the /setSystemAdmin file, part of the alphapd component. Successful exploitation enables remote attackers to execute commands on the system. The exploit is publicly available. This vulnerability impacts products no longer supported by the maintainer.

Recommendations Versions prior to 1.14.11 should not be used.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-2218

Affected Products

D-Link Dcs-933L

References · 10

• 🔥 https://github.com/jinhao118/cve/blob/main/D-Link%20DCS933L_v1.14.11.md#poc · Exploit
• 🔥 https://github.com/jinhao118/cve/blob/main/D-Link%20DCS933L_v1.14.11.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2218 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2218 · Vendor Advisory
• https://t.me/CVEtracker/44176 · Telegram Post
• https://vuldb.com/?ctiid.344936 · Note
• https://vuldb.com/?id.344936 · Note
• https://dlink.com · Note
• https://t.me/cveNotify/151366 · Telegram Post
• https://vuldb.com/?submit.753247 · Note