CVE-2026-108971: Improper Verification of Cryptographic Signature in D-Link DCS-930L

The vulnerability CVE-2026-108971 affects the D-Link DCS-930L B1.08B4 firmware. It involves improper verification of cryptographic signatures in the mpfd_decode function within the bootloader_region.bin component of the Emergency HTTP Recovery Server. An attacker can remotely manipulate the firmware argument to bypass signature verification, potentially allowing unauthorized firmware to be accepted. An exploit for this vulnerability has been published, increasing the risk of exploitation. The CVSS 4.0 score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, availability, and security requirements. No patch or remediation information is provided in the input data.

Successful exploitation of this vulnerability could allow an attacker to bypass cryptographic signature verification on firmware updates, potentially enabling unauthorized firmware installation. This could lead to full compromise of the device, including unauthorized control, data exposure, or disruption of service. The vulnerability is remotely exploitable without authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Emergency HTTP Recovery Server interface and monitor for suspicious activity related to firmware update attempts. Follow vendor communications for updates on patches or mitigations.