CVE-2016-11021
dlink dcs-930l firmware
Published 9 Mar 2020 · updated 17 Jun 2026 · Analyzed
7.2 High · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Description
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
References
- www.exploit-db.com/exploits/39437 · Exploit, Third Party Advisory, VDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-11021 · US Government Resource