Unrestricted File Upload Vulnerability in D-Link DCS-931L
CVE-2015-2049

Currently unrated

Key Information:

Vendor
D-Link
Status
Dcs-931l Firmware
Vendor
CVE Published:
23 February 2015

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 82%

Summary

The D-Link DCS-931L camera is susceptible to an unrestricted file upload vulnerability that enables remote authenticated users to execute arbitrary code. By uploading a file with an executable extension, attackers can compromise the device’s security. This flaw exists in firmware version 1.04 and earlier, highlighting the necessity for users to update their devices to secure versions to prevent potential exploitation.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2015-2049
Created by Rapid7

References

https://www.exploit-db.com/exploits/39192/
exploitx_refsource_EXPLOIT-DB
http://securityadvisories.dlink.com/security/publication....
x_refsource_CONFIRM
http://www.kb.cert.org/vuls/id/377348
third-party-advisoryx_refsource_CERT-VN

EPSS Score

82% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.