CVE-2026-13545: D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection
A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub400E40 of the file setconf.cgi of the component POST Parameter Handler. Such manipulation of the argument UID leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13545?
The severity of CVE-2026-13545 is rated high, specifically a score of 7.4.
What vulnerability does CVE-2026-13545 exploit?
CVE-2026-13545 exploits an OS command injection vulnerability found in the D-Link DCS-935L's POST Parameter Handler.
How does an attacker exploit CVE-2026-13545?
An attacker can exploit CVE-2026-13545 by manipulating the UID argument in the setconf.cgi file to execute arbitrary commands.
Is CVE-2026-13545 remotely exploitable?
Yes, CVE-2026-13545 can be exploited remotely.
How can I mitigate the risks of CVE-2026-13545?
To mitigate the risks of CVE-2026-13545, it is recommended to update the D-Link DCS-935L firmware to the latest version that addresses this vulnerability.