Log in Start free

Vulnerability · Published Jan 28, 2026 · Assigned by VulDB

CVE-2026-1532D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal

Low 2.4

In plain English

A low-severity path traversal in DCS-700L from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.7%top 47.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. The manipulation of the argument UploadMusic leads to path traversal. The attack can only be initiated within the local network. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products (as reported)

VendorProductVersions
D-Link DCS-700L 1.03.09

Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References