Listen to this Post
How the CVE Works
The vulnerability exists in the `alphapd` component of the D-Link DCS-930L IP camera firmware version 1.15.04. It specifically affects the `/setSystemAdmin` file, where the `AdminID` argument is not properly sanitized before being used. An attacker can exploit this by sending a specially crafted HTTP request to the device, injecting shell commands through the `AdminID` parameter. This manipulation leads to command injection. The attack can be executed remotely over the network without requiring authentication or user interaction. The flaw allows arbitrary commands to run with the privileges of the vulnerable `alphapd` process. Publicly disclosed exploit code increases the risk of utilization. The product is no longer supported by the vendor, meaning no official patch is available.
DailyCVE Form
Platform: D-Link
Version: 1.15.04
Vulnerability: Command Injection
Severity: Medium
Date: 2025-12-08
Prediction: No patch expected
What Undercode Say
Analytics
- Public exploit available.
- CVSS 4.0: 5.3 Medium.
- CVSS 3.1: 8.8 High.
- EPSS Score: 0.5%.
- CWE-77: Command Injection.
Bash commands and codes
Example curl request for exploitation (for educational purposes) curl -X POST http://<TARGET_IP>/setSystemAdmin --data "AdminID=1;malicious_command" Command to check device firmware version find / -name "version" 2>/dev/null | head -5
How Exploit
- Remote attackers send malicious HTTP POST requests.
- They inject shell metacharacters into the `AdminID` parameter.
- The injected commands are executed by the system shell.
- This can lead to full device compromise.
Protection from this CVE
- Isolate affected cameras from the internet.
- Replace with supported hardware.
- Implement strict network segmentation.
Impact
- Arbitrary command execution on camera.
- Potential network pivoting point.
- Compromise of video feed confidentiality.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
