CVE-2026-8260 D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow

High 8.7 Published 11 May 2026 Updated 12 May 2026

Remote attackers can trigger a buffer overflow in the HNAP service via the AdminPassword argument, potentially leading to code execution on D-Link DCS-935L cameras.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-8260?

CVE-2026-8260 is a high-severity memory corruption vulnerability in D-Link DCS-935L, published on 11 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

Weakness: CWE-120, CWE-119

Which versions are affected by CVE-2026-8260?

It affects 1 product.

Products include Dlink Dcs-935l Firmware.

How do I fix CVE-2026-8260?

No fix has been published for CVE-2026-8260 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-8260 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8260 exists.

Sources

Also known as GHSA-m69q-2cfc-q63c.