CVE-2026-12174: D-Link DCS-935L HTTP rhea snprintf format string

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-13 · updated 2026-07-23
Weakness: CWE-119

Description

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Affected products

D-Link DCS-935L: 1.10.01

References

https://github.com/Real-Simplicity/cve-database/tree/main/CVE_Report_DLink_DCS935L_Format_String
https://vuldb.com/cve/CVE-2026-12174
https://vuldb.com/submit/837209
https://vuldb.com/vuln/370815
https://vuldb.com/vuln/370815/cti
https://www.dlink.com/

Get alerted when CVE-2026-12174 or the next vulnerability affects your stack