CVE-2026-12174 is a format string vulnerability affecting D-Link DCS-935L version 1.10.01. The flaw is located in the snprintf function within the /web/cgi-bin/greece/rhea HTTP handler component. This vulnerability allows remote attackers to manipulate input data to exploit the format string issue. The vulnerability has been publicly disclosed but no vendor-provided fix or mitigation is currently documented. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code or cause denial of service by leveraging the format string flaw in the HTTP handler. The vulnerability impacts confidentiality, integrity, and availability of the affected device. Since the attack can be launched remotely without authentication or user interaction, the risk is significant for affected devices running version 1.10.01.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for any unusual activity. No vendor-provided mitigation or temporary fix is currently documented.