A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
为什么是这个 VPI(可解释·实验性)
VPI 计算依据
| 影响度 | 74.00 |
| 利用信号(存在 PoC) | ×1.20 |
| VPI | 88.80 |
VPI 公式 vpi-v1
| 来源 | CVSS 版本 | 基础评分 | 严重程度 | 向量字符串 | 评估日期 |
|---|---|---|---|---|---|
| NVDNIST | 4.0 | 7.4 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | 2026. 05. 13. |
| NVDNIST | 3.1 |
| 8.8 |
HIGH |
| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2026. 05. 13. |
| NVDNIST | 2.0 | 9.0 | HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C | 2026. 05. 13. |