Critical severity · published Jan 7, 2020
CVE-2019-17146
This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102
9.8
CVSS
9.5%
EPSS
No
On KEV
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction request header, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8458.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dcs-935l Firmware · Dlink
through 1.12.101 · source: NVD
DF
Dcs-960l Firmware · Dlink
through 1.07.102 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17146
Vendor Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10142
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-1031/
More from Dcs-935l Firmware
9.8
CVE-2025-10779
A vulnerability was found in D-Link DCS-935L up to 1.13.01
8.8
CVE-2026-13545
D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection
8.8
CVE-2026-12174
D-Link DCS-935L HTTP rhea snprintf format string
8.8
CVE-2026-8260
D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow