CVE-2016-11021

published 2020-03-09

CVE-2016-11021: setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.

Priority P1 85 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

KEV ITW EXPLOIT

setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dcs-930l_firmware	< 2.12	2.12

Detection & IOCs extracted from sources · hover to see the quote

url /setSystemCommand↗

other SystemCommand (parameter)↗

• → Monitor HTTP requests targeting the /setSystemCommand endpoint on D-Link DCS-930L devices for OS command injection payloads in the SystemCommand parameter. ↗
• → Alert on any authenticated POST/GET to /setSystemCommand containing shell metacharacters or command separators in the SystemCommand parameter value. ↗

• · Exploitation requires valid credentials; unauthenticated access to the endpoint is not sufficient — monitor for brute-force or credential-stuffing activity preceding exploitation attempts. ↗
• · Only firmware versions prior to 2.12 are vulnerable; devices running 2.12 or later are not affected. End-of-life devices should be disconnected if patching is not possible. ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

vulncheck 7.2 HIGH

cisa 7.2 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78