Vulnerability record · CVE-2016-11021 · published 9 March 2020
CVE-2016-11021: D-Link DCS-930L camera OS command injection via SystemCommand parameter
Dlink · Dcs 930l Firmware
D-Link DCS-930L devices before firmware 2.12 pass the SystemCommand parameter to setSystemCommand without sanitizing it, allowing OS command injection. Because the device is end-of-life and widely deployed, unpatched cameras remain exposed and are listed in CISA's Known Exploited Vulnerabilities catalog.
Description
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with public exploit code and very high EPSS, but exploitation requires administrative privileges and the product is end-of-life, limiting exposure to reachable, unpatched devices.
What it is
D-Link DCS-930L devices before firmware 2.12 pass the SystemCommand parameter to setSystemCommand without sanitizing it, allowing OS command injection. Because the device is end-of-life and widely deployed, unpatched cameras remain exposed and are listed in CISA's Known Exploited Vulnerabilities catalog.
Impact
An attacker who can reach the management interface can run arbitrary OS commands on the camera, gaining full control of the device and any data or network access it holds.
Attack surface
Reachable over the network via the device's web management interface (AV:N). The CVSS vector requires high privileges (PR:H), so the attacker needs valid administrative access; no user interaction is required.
Exploitation
CISA added this to KEV on 2022-03-25 with a 2022-04-15 remediation due date, and public Exploit-DB code exists; EPSS is 0.6887 (99.3rd percentile), indicating high likelihood of exploitation activity.
What to do
- Apply firmware 2.12 or later if the device is still supported; otherwise treat it as unpatchable.
- Disconnect or replace end-of-life DCS-930L units, as CISA's required action states.
- If the device must stay online, isolate it on a segmented VLAN with no access to trusted networks.
- Restrict management interface access to trusted administrative hosts and change default credentials.
- Monitor for and block outbound traffic from the camera to unexpected destinations.
Detection
- Inspect web server or device logs for requests containing shell metacharacters in the SystemCommand parameter.
- Alert on unexpected outbound connections or processes spawned by the camera's management service.
- Scan the network for DCS-930L devices and verify firmware version against 2.12.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2016-11021 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "D-Link DCS-930L Devices OS Command Injection Vulnerability". Required action: The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 15 April 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.exploit-db.com/exploits/39437 | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/39437 | ExploitThird Party AdvisoryVDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-11021 | US Government Resource |
Track CVE-2016-11021 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-11021), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
