Unrated severityNVD Advisory· Published Feb 10, 2026· Updated Feb 23, 2026

D-Link DCS-931L setSysAdmin os command injection

CVE-2026-2260

Description

A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin. The manipulation of the argument AdminID results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

Dlink/DCS-931Lllm-create
Range: <=1.13.0
D-Link/DCS-931Lv5
Range: 1.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/cha0yang1/CVE/blob/main/DLinkRce.mdmitreexploit
vuldb.commitrethird-party-advisory
github.com/cha0yang1/CVE/blob/main/DLinkRce.mdmitrerelated
vuldb.commitresignaturepermissions-required
vuldb.commitrevdb-entrytechnical-description
www.dlink.commitreproduct

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000