CVE-2026-108971: D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification

Published Oct 13, 2026

Updated

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfddecode of the file bootloaderregion.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.

Affected Software

1 affected component

D-Link DCS-930L=B1.08B4

Event History

Oct 13, 2026

CVE Published

via MITRE·05:45 AM

Data Sourced

via MITRE·05:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need credentials or local access?

The vector indicates no privileges are required and the attack can be performed remotely. User interaction is required.

How can I determine whether my device is in scope?

The reported affected product and version is the D-Link DCS-930L running B1.08B4. The affected component is its Emergency HTTP Recovery Server, specifically the mpfd_decode function in bootloader_region.bin.

Is public exploitation information available?

Yes. The available data states that an exploit has been published and may be used.