A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
References
| Link | Resource |
|---|---|
| https://github.com/0xcc12138/DCS-935L-HNAP-Service-CVE | Exploit Third Party Advisory |
| https://vuldb.com/submit/809888 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/362557 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/362557/cti | Permissions Required VDB Entry |
| https://www.dlink.com/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
12 May 2026, 19:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:dlink:dcs-935l:-:*:*:*:*:*:*:* cpe:2.3:o:dlink:dcs-935l_firmware:*:*:*:*:*:*:*:* |
|
| First Time |
Dlink
Dlink dcs-935l Firmware Dlink dcs-935l |
|
| References | () https://github.com/0xcc12138/DCS-935L-HNAP-Service-CVE - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/submit/809888 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/362557 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/362557/cti - Permissions Required, VDB Entry | |
| References | () https://www.dlink.com/ - Product |
11 May 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-11 02:16
Updated : 2026-05-12 19:45
NVD link : CVE-2026-8260
Mitre link : CVE-2026-8260
CVE.ORG link : CVE-2026-8260
JSON object : View
Products Affected
dlink
- dcs-935l_firmware
- dcs-935l