CVE-2026-12174

Katalog CVE

CVSS 8.8 · High EPSS 0,58%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada dlink dcs-935l firmware. Skor CVSS 3.1 8.8 (High) menurut vuldb.com.

Deskripsi (NVD)

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Rincian

Terbit di NVD

13 Juni 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Real-Simplicity/cve-database/tree/main/CVE_Report_DLink_DCS935L_Format_String advisory pihak ketiga
• https://vuldb.com/cve/CVE-2026-12174 advisory pihak ketiga · vdb entry
• https://vuldb.com/submit/837209 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/370815 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/370815/cti permissions required · vdb entry
• https://www.dlink.com/ product