CVE-2026-2260: D-Link DCS-931L setSysAdmin os command injection
A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin. The manipulation of the argument AdminID results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2260?
CVE-2026-2260 is considered a critical severity vulnerability due to its potential for remote command injection.
How do I fix CVE-2026-2260?
To fix CVE-2026-2260, update the D-Link DCS-931L firmware to a version above 1.13.0.
What kind of attack can CVE-2026-2260 enable?
CVE-2026-2260 can enable an attacker to execute arbitrary operating system commands on the vulnerable device.
Is CVE-2026-2260 exploitable remotely?
Yes, CVE-2026-2260 can be exploited remotely, allowing attackers to target devices over the internet.
Which devices are affected by CVE-2026-2260?
CVE-2026-2260 affects the D-Link DCS-931L cameras running firmware version up to and including 1.13.0.