ID
VAR-202505-1807
CVE
CVE-2025-4841
TITLE
D-Link Systems, Inc. of DCS-932L Buffer error vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in D-Link DCS-932L 2.18.01 and classified as critical. Affected by this issue is the function sub_404780 of the file /bin/gpio. The manipulation of the argument CameraName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. of DCS-932L The firmware contains a buffer error vulnerability, a stack-based buffer overflow vulnerability, and an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DCS-932L is a network surveillance camera from D-Link, a Chinese company. It is used for security and monitoring. The vulnerability is caused by the parameter CameraName in the file /bin/gpio failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service
Trust: 2.16
IOT TAXONOMY
| category: | ['IoT'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | dlink | model: | dcs-932l | scope: | eq | version: | 2.18.01 | Trust: 1.0 |
| vendor: | d link | model: | dcs-932l | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | d link | model: | dcs-932l | scope: | - | version: | - | Trust: 0.8 |
| vendor: | d link | model: | dcs-932l | scope: | eq | version: | dcs-932l firmware 2.18.01 | Trust: 0.8 |
| vendor: | d link | model: | dcs-932l | scope: | eq | version: | 2.18.01 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-119 | Trust: 1.0 |
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Buffer error (CWE-119) [ others ] | Trust: 0.8 |
| problemtype: | Stack-based buffer overflow (CWE-121) [ others ] | Trust: 0.8 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-4841 | Trust: 3.2 |
| db: | VULDB | id: | 309308 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-006205 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-10947 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/beacox/iot_vuln/tree/main/d-link/dcs-932l/gpio_bof | Trust: 2.4 |
| url: | https://vuldb.com/?id.309308 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.574924 | Trust: 1.8 |
| url: | https://www.dlink.com/ | Trust: 1.8 |
| url: | https://vuldb.com/?ctiid.309308 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-4841 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2025-10947 |
| db: | JVNDB | id: | JVNDB-2025-006205 |
| db: | NVD | id: | CVE-2025-4841 |
LAST UPDATE DATE
2025-06-06T23:24:43.783000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-10947 | date: | 2025-05-29T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-006205 | date: | 2025-06-04T05:45:00 |
| db: | NVD | id: | CVE-2025-4841 | date: | 2025-06-03T15:57:42.837 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-10947 | date: | 2025-05-29T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-006205 | date: | 2025-06-04T00:00:00 |
| db: | NVD | id: | CVE-2025-4841 | date: | 2025-05-17T23:15:36.407 |