CVE-2026-108971
Critical
Description
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
SeverityCritical
CVSS9.6
Exploit probability—
Product
D-link Dcs-930l
PublishedOct 13, 2026
First seenOct 13, 2026
Weakness typeCWE-347CWE-347CWE-345CWE-345
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| d-link dcs-930l | B1.08B4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.