ByteOS Network

CVE Vulnerability Details :

CVE-2026-12174

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-13 Jun, 2026 | 20:15

Updated At-13 Jun, 2026 | 20:15

▼CVE Numbering Authority (CNA)

D-Link DCS-935L HTTP rhea snprintf format string

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Affected Products

Vendor

D-Link Corporation

Product

DCS-935L

CPEs

cpe:2.3:h:d-link:dcs-935l:*:*:*:*:*:*:*:*

Modules

HTTP Handler

Versions

Affected

1.10.01

Problem Types

Type	CWE ID	Description
CWE	CWE-134	Format String
CWE	CWE-119	Memory Corruption

Type: CWE

CWE ID: CWE-134

Description: Format String

Type: CWE

CWE ID: CWE-119

Description: Memory Corruption

Metrics

Version	Base score	Base severity	Vector
4.0	8.7	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
2.0	9.0	N/A	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR

Version: 4.0

Base score: 8.7

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

Version: 3.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

Version: 2.0

Base score: 9.0

Base severity: N/A

Vector:

AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR

Credits

reporter

Simplicity (VulDB User)

Timeline

Event	Date
Advisory disclosed	2026-06-13 00:00:00
VulDB entry created	2026-06-13 02:00:00
VulDB entry last update	2026-06-13 07:41:18

Event: Advisory disclosed

Date: 2026-06-13 00:00:00

Event: VulDB entry created

Date: 2026-06-13 02:00:00

Event: VulDB entry last update

Date: 2026-06-13 07:41:18

References

Hyperlink	Resource
https://vuldb.com/vuln/370815	vdb-entry technical-description
https://vuldb.com/vuln/370815/cti	signature permissions-required
https://vuldb.com/cve/CVE-2026-12174	third-party-advisory
https://vuldb.com/submit/837209	third-party-advisory
https://github.com/Real-Simplicity/cve-database/tree/main/CVE_Report_DLink_DCS935L_Format_String	exploit
https://www.dlink.com/	product