Vulnerability record · CVE-2015-2049 · published 23 February 2015
CVE-2015-2049: D-Link DCS-931L unrestricted file upload enables remote code execution
Dlink · Dcs 931l Firmware
D-Link DCS-931L firmware 1.04 and earlier permits an authenticated user to upload a file with an executable extension, which the device then executes. Because the camera is network-facing and the flaw yields full code execution, it is a serious risk for exposed devices.
Description
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
AV:N/AC:L/Au:S/C:C/I:C/A:C
Automated analysis
high priorityRemote authenticated code execution with public exploit code and very high EPSS, though exploitation requires valid credentials.
What it is
D-Link DCS-931L firmware 1.04 and earlier permits an authenticated user to upload a file with an executable extension, which the device then executes. Because the camera is network-facing and the flaw yields full code execution, it is a serious risk for exposed devices.
Impact
An attacker with valid credentials gains arbitrary code execution on the camera, allowing full compromise of confidentiality, integrity and availability.
Attack surface
Reachable over the network via the device's web interface; the CVSS vector (AV:N/AC:L/Au:S) indicates authentication is required and no user interaction is needed.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.667, 99.3rd percentile) and a public Exploit-DB entry (39192) exists, indicating known exploit code is available.
What to do
- Update D-Link DCS-931L firmware beyond 1.04 per the vendor advisory SAP10049.
- If patching is not possible, isolate cameras on a segmented VLAN and block internet exposure.
- Change default credentials and enforce strong unique passwords on all camera accounts.
- Restrict management/web interface access to trusted administrative hosts only.
- Monitor vendor and CERT/CC advisories for further guidance on this device.
Detection
- Alert on uploads of files with executable extensions (e.g., .php, .cgi, .sh) to the camera's web interface.
- Monitor camera logs and network traffic for unexpected POST requests to upload endpoints.
- Watch for anomalous outbound connections or new processes on the device indicating code execution.
- Baseline normal camera traffic and flag deviations from expected management patterns.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10049 | Vendor Advisory |
| http://www.kb.cert.org/vuls/id/377348 | Third Party AdvisoryUS Government Resource |
| https://www.exploit-db.com/exploits/39192/ | |
| http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10049 | Vendor Advisory |
| http://www.kb.cert.org/vuls/id/377348 | Third Party AdvisoryUS Government Resource |
| https://www.exploit-db.com/exploits/39192/ |
Track CVE-2015-2049 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-2049), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
