ID
VAR-202505-1786
CVE
CVE-2025-4842
TITLE
D-Link Systems, Inc. of DCS-932L Buffer error vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in D-Link DCS-932L 2.18.01. It has been declared as critical. This vulnerability affects the function isUCPCameraNameChanged of the file /sbin/ucp. The manipulation of the argument CameraName leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. of DCS-932L The firmware contains a buffer error vulnerability, a stack-based buffer overflow vulnerability, and an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DCS-932L is a network surveillance camera from D-Link, a Chinese company. It is used for security and monitoring. The vulnerability is caused by the parameter CameraName in the file /sbin/ucp failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service
Trust: 2.16
IOT TAXONOMY
| category: | ['IoT'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | dlink | model: | dcs-932l | scope: | eq | version: | 2.18.01 | Trust: 1.0 |
| vendor: | d link | model: | dcs-932l | scope: | eq | version: | dcs-932l firmware 2.18.01 | Trust: 0.8 |
| vendor: | d link | model: | dcs-932l | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | d link | model: | dcs-932l | scope: | - | version: | - | Trust: 0.8 |
| vendor: | d link | model: | dcs-932l | scope: | eq | version: | 2.18.01 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-119 | Trust: 1.0 |
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Buffer error (CWE-119) [ others ] | Trust: 0.8 |
| problemtype: | Stack-based buffer overflow (CWE-121) [ others ] | Trust: 0.8 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-4842 | Trust: 3.2 |
| db: | VULDB | id: | 309310 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-006319 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-10948 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/beacox/iot_vuln/tree/main/d-link/dcs-932l/ucp_bof | Trust: 2.4 |
| url: | https://vuldb.com/?id.309310 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.574925 | Trust: 1.8 |
| url: | https://www.dlink.com/ | Trust: 1.8 |
| url: | https://vuldb.com/?ctiid.309310 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-4842 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2025-10948 |
| db: | JVNDB | id: | JVNDB-2025-006319 |
| db: | NVD | id: | CVE-2025-4842 |
LAST UPDATE DATE
2025-06-06T23:25:55.278000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-10948 | date: | 2025-05-29T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-006319 | date: | 2025-06-05T05:58:00 |
| db: | NVD | id: | CVE-2025-4842 | date: | 2025-06-04T20:11:46.547 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-10948 | date: | 2025-05-29T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-006319 | date: | 2025-06-05T00:00:00 |
| db: | NVD | id: | CVE-2025-4842 | date: | 2025-05-17T23:15:36.617 |