CVE-2026-12174 describes a format string vulnerability in D-Link DCS-935L firmware version 1.10.01. The issue occurs in the snprintf function used in the /web/cgi-bin/greece/rhea HTTP handler component. Remote attackers can exploit this vulnerability by manipulating input data to the format string, potentially leading to memory corruption or other impacts associated with format string flaws. The vulnerability has been publicly disclosed, but no vendor-provided patch or official remediation level is available at this time.

The vulnerability allows remote attackers to exploit a format string flaw in the HTTP handler component of the affected device. This can lead to memory corruption or other unintended behavior, potentially compromising the device's integrity or availability. The CVSS 4.0 score of 8.7 indicates a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality, integrity, and availability impacts are all rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor D-Link's advisories for updates. Until a patch is released, consider limiting network exposure of the affected device to trusted networks only and avoid exposing the device's HTTP interface to untrusted networks.