Vulnerability · Published May 11, 2026 · Assigned by VulDB
CVE-2026-8260D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow
High 8.8
In plain English
A high-severity buffer overflow in DCS-935L from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 37.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-362557 | D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow vdb-entry, technical-description
- VDB-362557 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #809888 | D-Link DCS-935L ≤1.10.01 Buffer Overflow third-party-advisory
- https://github.com/0xcc12138/DCS-935L-HNAP-Service-CVE exploit
- https://www.dlink.com/ product