PT-2026-7070 · D Link · D-Link Dcs-933L

Allanp0E · CVE-2026-2218 · Published 2026-02-06 · Updated 2026-02-09

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-933L versions up to 1.14.11

Description A flaw exists in D-Link DCS-933L that allows for command injection. This issue stems from manipulating the AdminID argument within an unknown function of the /setSystemAdmin file, part of the alphapd component. Successful exploitation enables remote attackers to execute commands on the system. The exploit is publicly available. This vulnerability impacts products no longer supported by the maintainer.

Recommendations Versions prior to 1.14.11 should not be used.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BDU:2026-08539

CVE-2026-2218

Affected Products

D-Link Dcs-933L

References · 11

• 🔥 https://github.com/jinhao118/cve/blob/main/D-Link%20DCS933L_v1.14.11.md#poc · Exploit
• 🔥 https://github.com/jinhao118/cve/blob/main/D-Link%20DCS933L_v1.14.11.md · Exploit
• https://osv.dev/vulnerability/CVE-2026-2218 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-08539 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2218 · Security Note
• https://t.me/cveNotify/151366 · Telegram Post
• https://t.me/CVEtracker/44176 · Telegram Post
• https://vuldb.com/?ctiid.344936 · Note
• https://dlink.com · Note
• https://vuldb.com/?submit.753247 · Note
• https://vuldb.com/?id.344936 · Note