CVE-2026-11497: D-Link DCS-5615 Boa Webserver boa.conf least privilege violation
A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of the component Boa Webserver. Such manipulation leads to least privilege violation. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the device's web/management interface (e.g., block external Internet access and allow only trusted IPs) using firewall rules or ACLs to prevent remote exploitation.
- Compensating control
Isolate the affected D-Link DCS-5615 device from untrusted networks (remove from public Internet, place on a segregated VLAN) until an official vendor remediation is available and applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11497?
The severity of CVE-2026-11497 is rated as medium with a score of 5.3.
How do I fix CVE-2026-11497?
To fix CVE-2026-11497, ensure that the Boa Webserver configuration is properly secured and implement least privilege practices.
What types of attacks are possible with CVE-2026-11497?
CVE-2026-11497 allows for remote attacks that exploit least privilege violations.
Which component is affected by CVE-2026-11497?
CVE-2026-11497 affects the Boa Webserver configuration file boa.conf on the D-Link DCS-5615.
What is the attack vector for CVE-2026-11497?
The attack vector for CVE-2026-11497 is classified as remote, allowing attackers to exploit the vulnerability from across the network.