D-Link DCS-930L: Missing signature verification in bootloader firmware update
Summary
The Emergency HTTP Recovery Server in the bootloader of the D-Link DCS-930L network camera, firmware B1.08B4, accepts firmware images without any cryptographic signature check. The validator only checks a uImage magic value and header fields, so a crafted image with a valid header is written to the kernel partition and executed on the next boot. Recovery mode must be entered by holding the reset button during power-on, and the sources disagree on how easily the server can be reached over the network. The product is end-of-life and no fix is available.
Affected
- D-Link DCS-930L, firmware B1.08B4 (firmware 1.08)
- Other revisions: Unknown.
Fixed in
Unknown. No fix or D-Link advisory for this CVE was found. The product is end-of-life.
Workaround
- Isolate the camera on a dedicated VLAN and restrict access to trusted management or internal subnets.
- Do not expose the camera to the internet and check for port forwarding or cloud relay access.
- Disable or block access to TCP port 80 on the device from untrusted networks.
Exploitation
- A public GitHub write-up describes the attack. Its technical details have not been independently reproduced.
- ThehackerWire reports no public PoC; this conflicts with the GitHub write-up.
- CISA SSVC lists exploitation as PoC, not automatable.
- Not known to be exploited in the wild; not listed in the CISA KEV catalog according to the sources.
Our recommendation
- Retire and replace the DCS-930L, as recommended by D-Link for end-of-life products.
- If the device must stay in service, isolate it on a dedicated VLAN and block all inbound access from untrusted networks.
- Check whether the camera is reachable from the internet or from guest networks and remove any exposure.
- Monitor the device and network traffic for unexpected HTTP POST requests to the camera on TCP port 80.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub write-up: D-Link DCS-930L Bootloader Emergency Room firmware flash github.com
- VulDB entry CVE-2026-108971 vuldb.com
- D-Link end-of-life notice SAP10247 supportannouncement.us.dlink.com
- D-Link DCS-930L product page www.dlink.com
- ThehackerWire: CVE-2026-108971 www.thehackerwire.com
- Strix CVE record CVE-2026-108971 www.strix.ai
- HOL Guard CVE record CVE-2026-108971 hol.org
- Positive Technologies PT-2026-114748 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:36.
Original description (NVD)
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.