CVE-2026-108971

CriticalCVSS 9.6/10Last modified Oct 14, 2026

Description

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-345 CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1089727.3A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_sta CVE-2026-1089737.3A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of th CVE-2026-1089747.3A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?CVE-2026-1089757.3A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_f CVE-2026-1089767.8GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list CVE-2026-1089785.5Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects CVE-2026-108988.3Stack buffer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to p CVE-2026-1089808.8Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path fro CVE-2026-1089813.6ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., CVE-2026-1089827.2VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary s CVE-2026-1089839.8A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .CVE-2026-1089847.5A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .