CVE-2025-4843 is a high severity stack-based buffer overflow (CVSS 8.8) in the D-Link DCS-932L camera, firmware 2.18.01. The CameraName argument reaches the function SubUPnPCSInit in /sbin/udev. The record says the product is no longer supported, so no fix is expected: isolate the camera or replace it.
What's affected
The record names the D-Link DCS-932L running version 2.18.01. The vulnerable code is the function SubUPnPCSInit in the file /sbin/udev, and the CameraName argument is what triggers the stack-based overflow. The record says the attack can be launched remotely.
The record files the flaw under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), CWE-787 (Out-of-bounds Write). These cover memory safety errors in general, a stack-based overflow and an out-of-bounds write.
The record also states that this vulnerability only affects products that are no longer supported by the maintainer. That means you should not wait for a firmware update. The references are a public write up of the flaw and VulDB entries, and none of them is a D-Link advisory with a fixed build.
The base vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It needs low privileges, which in practice means a valid login on the device, but nothing from a user. If the camera uses a default or shared password, that barrier is thin. Impact on confidentiality, integrity and availability is rated high on all three.
How to check if you're exposed
First, find out whether you own one of these cameras. Look at the model label on the device, or the model name on its web page. Check the firmware version in the device status page. If it is a DCS-932L on 2.18.01, it matches the record.
Then find them on the network. Cameras are often added by a facilities team and never reach the asset inventory. Your DHCP lease list and a scan of your own address space for the camera web interface will usually find them.
Next, check exposure. Look in your router and firewall for port forwards to the camera, for UPnP mappings, and for any remote viewing feature turned on. A camera with a path from the internet is the case to fix first.
Finally, check the camera password. If it was never changed from the default, change it before anything else, since the record needs a login of some kind.
What to do now
- Replace the DCS-932L with a model that still receives security updates. The record says this product is out of support.
- Until it is replaced, remove any port forwarding and turn off UPnP and remote access for the device.
- Move the camera onto its own network segment that cannot reach business systems, and block its access to the internet.
- Change the device password to a long unique value, and remove any shared accounts.
- Record the camera in your asset inventory with an end of life date so it does not come back unnoticed.
- Check the D-Link support page for the model in case a notice has been added since the record was published.
Why it matters
A stack-based buffer overflow happens when input is copied into a fixed size area on the call stack without a length check. The stack also holds control data for the running function, which is why this class is taken seriously. The record does not describe the end result for this camera, but a high rating on all three impact areas tells you the scorer considered a full compromise of the device possible.
Cameras are a good example of why unsupported hardware is a security cost and not just an old gadget. They sit on the network around the clock, they run a small embedded system that is rarely updated, and they can see inside a building. The same CameraName input is reported in three different programs on this device (/bin/gpio, /sbin/ucp and /sbin/udev), which suggests the value is passed around without checks.
The CVE record notes that an exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Will D-Link release a fix for CVE-2025-4843?
The CVE record says the product is no longer supported by the maintainer, so a fix should not be expected. Check the D-Link support page for any notice, and plan to replace the camera.
Is it enough to change the camera password?
No. The record needs a login, so a strong unique password raises the bar, but it does not remove the overflow. Isolation from the internet and from internal networks, and replacement, are the real fixes.
Sources
- NVD record for CVE-2025-4843
- github.com reference
- vuldb.com reference
- vuldb.com reference
- vuldb.com reference
- www.dlink.com reference
Last reviewed: 18 October 2026.
