CVE-2025-10779: High Buffer Overflow in D-Link DCS-935L

CVE-2025-10779 is a high severity (CVSS 8.8) stack based buffer overflow in D-Link DCS-935L cameras up to firmware 1.13.01. The record says the product is no longer supported, so no fix is expected. Isolate the camera from the internet or replace it.

What's affected

The record lists D-Link DCS-935L and its firmware, up to version 1.13.01. The weak spot is the function sub_402280 handling the /HNAP1/ interface, where the HNAP_AUTH and SOAPAction values lead to a stack based buffer overflow. It can be reached over the network.

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. A low privilege login is needed, and the rating is high for confidentiality, integrity and availability.

Fixed versions: none. The record states the vulnerability only affects products that are no longer supported by the maintainer. That means you should not wait for a firmware update. Check D-Link's own support pages to confirm the status for your hardware revision. The record says an exploit has been made public.

The weakness classes are CWE-119 (improper restriction of operations within a memory buffer), CWE-121 (stack based buffer overflow) and CWE-787 (out of bounds write).

How to check if you're exposed

Cameras rarely appear in software inventories, so start with network discovery.

1. List cameras on your network by model. Look at the label on the device or its web page for the model name DCS-935L.
2. Read the firmware version on the device status page. Versions up to 1.13.01 are in scope.
3. Check whether the camera has a port forward on your router, or a cloud relay, that exposes its web interface to the internet. Review your router's port forwarding list.
4. On a network where you can, scan for the camera's web port from outside to confirm what is reachable.
5. Look at the router or firewall logs for unexpected connections to the camera.

Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory where you can look up the CVE record alongside related weaknesses. It will not scan firmware, but it can help with the apps and services around the camera.

What to do now

1. Take any exposed camera off the internet. Remove port forwards and disable remote access features you do not need.
2. Put the camera on its own network segment so it cannot reach computers or servers.
3. Change the camera password to a long unique one, since a login is required to reach the flaw.
4. Check D-Link's support page for your model for any notice. The record says the product is unsupported.
5. Plan to replace the camera with a supported model. Unsupported devices stay unpatched.
6. Review who can reach the camera's management interface and limit it to a single admin host.
7. Keep a record of devices that have reached end of support so they are replaced on a schedule.

Why it matters

A stack based buffer overflow happens when code copies input into a fixed size memory area without checking its length. Data then overwrites neighbouring memory, which can crash the device or, in some cases, let an attacker take control of it. The advisory level details are thin here, and we do not describe how it is triggered.

The larger lesson is lifecycle. A flaw in a device that no longer gets updates will not be fixed, so the control has to be network isolation and replacement. The KEV flag in our data is false, so this is not listed as known exploited, though the record says a public exploit exists.

Try it yourself

The demo shows a zero day watch view, which helps when an advisory has no fix to apply yet.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold record for CVE-2025-10779

Last reviewed: 19 October 2026.