Log in Start free

Vulnerability · Published Feb 9, 2026 · Assigned by VulDB

CVE-2026-2218D-Link DCS-933L alphapd setSystemAdmin command injection

Medium 6.3

In plain English

A medium-severity command injection in DCS-933L from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)4.4%top 8.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in D-Link DCS-933L up to 1.14.11. This affects an unknown function of the file /setSystemAdmin of the component alphapd. This manipulation of the argument AdminID causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products (as reported)

VendorProductVersions
D-Link DCS-933L 1.14.01.14.11.14.21.14.31.14.41.14.51.14.61.14.7

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References