CVE-2016-11021

Name of the Vulnerable Software and Affected Versions D-Link DCS-930L devices version 2.12 and earlier

Description The issue allows a remote attacker to execute code via an OS command in the SystemCommand parameter. This is due to the lack of measures to neutralize special elements used in the OS command. Exploitation of the issue can allow a remote attacker to execute arbitrary commands.

Recommendations For D-Link DCS-930L devices version 2.12 and earlier, update to version 2.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the setSystemCommand function until a patch is available. Avoid using the SystemCommand parameter in the affected API endpoint until the issue is resolved.