Critical severity · published Oct 13, 2026
CVE-2026-108971
D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
9.6
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
DCS-930L · D-Link
B1.08B4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108971
vdb-entry
https://vuldb.com/vuln/416789
signature
https://vuldb.com/vuln/416789/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-108971
third-party-advisory
https://vuldb.com/submit/999605
exploit
https://github.com/sweethub521/somevul/blob/main/dlink-dcs930l-bootloader-emergency-room-flash.md
product
https://www.dlink.com/