CVE-2026-108971 is a critical-rated flaw in D-Link DCS-930L firmware B1.08B4: the Emergency HTTP Recovery Server does not properly verify cryptographic signatures, and a public exploit is available.
What Is It
CVE-2026-108971 is in the mpfd_decode function of bootloader_region.bin, part of the D-Link DCS-930L's Emergency HTTP Recovery Server component. Changing the firmware argument can lead to improper verification of a cryptographic signature. The record lists two weaknesses: CWE-345 (Insufficient Verification of Data Authenticity) and CWE-347 (Improper Verification of Cryptographic Signature).
VulDB, the CVE Numbering Authority, published the record on 2026-10-13. NVD currently lists it as "Deferred."
Why It Matters
The attack can be performed remotely. VulDB assigns these scores:
- CVSS 3.1: 9.6 CRITICAL (
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The attack works over the network, has low complexity and needs no privileges. It does require user interaction. Scope is changed, with high impact to confidentiality, integrity and availability. - CVSS 4.0: 8.6 HIGH, with exploit maturity rated Proof-of-Concept.
- CVSS 2.0: 10.0.
The CVE description states that "the exploit has been published and may be used." A public write-up appears in the references below.
KEV status: CVE-2026-108971 is not in the CISA Known Exploited Vulnerabilities catalog in the supplied data. A public exploit exists, but there is no KEV confirmation of active exploitation in the wild.
What's Vulnerable
- Vendor: D-Link
- Product: DCS-930L
- Component: Emergency HTTP Recovery Server
- Affected version: B1.08B4
- CPE:
cpe:2.3:h:d-link:dcs-930l:*:*:*:*:*:*:*:*
The supplied data does not list any other affected versions.
Patch Status
The supplied NVD data does not mention a vendor patch, fixed firmware version or advisory. The only vendor reference is the D-Link homepage. CISA has issued no required action because the CVE is not in KEV. Owners of DCS-930L devices running B1.08B4 should watch D-Link for an official response.