CVE-2026-12174: D-Link DCS-935L HTTP rhea snprintf format string

Synopsis

A format string vulnerability exists in the D-Link DCS-935L network camera, version 1.10.01, in the HTTP handler component responsible for processing requests to the /web/cgi-bin/greece/rhea endpoint via the snprintf function. The flaw is reachable over the network with low-privilege credentials and no victim interaction required. Successful exploitation gives an attacker full read, write, and crash capability over the affected device. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable HTTP handler is exposed over the network, so the attacker must be able to reach the device's HTTP service remotely.

• AuthenticationRequired

  The attack requires a low-privilege account on the device; unauthenticated access alone is not sufficient.

• Victim interactionNot required

  No victim action is needed; the attacker sends a crafted HTTP request directly to the endpoint.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configuration.

Blast Radius

• An attacker can read arbitrary memory from the device process, exposing stored credentials, session tokens, or configuration data.
• An attacker can write to arbitrary memory locations, modifying device behavior or injecting malicious logic into the running process.
• An attacker can crash the HTTP handler or the device firmware process entirely, taking the camera offline and disrupting monitoring coverage.
• Because confidentiality, integrity, and availability are all fully compromised at the vulnerable component level, an attacker effectively has full control over the affected device.