CVE-2026-13545

Name of the Vulnerable Software and Affected Versions D-Link DCS-935L version 1.10.01

Description An OS command injection issue exists in the POST Parameter Handler component within the setconf.cgi file. The vulnerability occurs in the sub 400E40() function due to the failure to neutralize special elements when processing the UID parameter. A remote attacker can manipulate this parameter to execute arbitrary commands on the device with root-equivalent privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the setconf.cgi endpoint to minimize the risk of exploitation.