CVE-2025-5573 is a medium severity (6.3) OS command injection in the D-Link DCS-932L camera on firmware 2.18.01. The record names no fixed firmware, so check D-Link's support notices, isolate the camera from untrusted networks, and plan to replace it if the model is no longer supported.
What's affected
The record lists D-Link DCS-932L firmware 2.18.01. The affected function is setSystemWizard or setSystemControl in the file /setSystemWizard, and the argument is AdminID. The description says the manipulation leads to OS command injection, that the attack may be launched remotely and that an exploit has been disclosed publicly.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Note that the score is 6.3, which is medium, even though the NVD text calls the issue critical. The score reflects that the vector requires low privileges. The title of this post follows the score.
The references are a researcher's write-up and the D-Link home page. No vendor advisory or fixed firmware is named. The CVE is not on the CISA KEV list.
How to check if you're exposed
- Log in to the camera's web interface and read the firmware version on the status page. Compare it with 2.18.01.
- Check D-Link's support site for the DCS-932L and read its notices. Older camera models are often listed as end of life.
- Check whether the camera is reachable from outside through port forwarding or UPnP.
- List camera and IoT devices on your network from the router's device table, so you know where else the model is deployed.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point.
What to do now
- Check D-Link's support pages for a firmware update or an end of life notice for this model.
- If the model is end of life, plan to replace it. A device that no longer gets patches should not sit on a network that matters.
- Remove port forwards to the camera and turn off UPnP if you do not need it.
- Put the camera on a separate network segment with no route to computers or storage.
- Change the administrator password to a unique one, since the flaw involves an account that has some privileges.
- Disable remote access features you do not use.
Why it matters
The classes are CWE-77 and CWE-78: command injection and OS command injection. A parameter submitted to the camera's web interface is passed to a shell command without being cleaned. On a small embedded device, running a command normally means controlling the device.
Cameras are a common first foothold because they are updated rarely and sit on the same network as everything else. Even at a medium score, the combination of a public write-up and no named fix is a reason to isolate the device now.
Quick check
Why does the record call it critical but score it medium?
The NVD text uses the VulDB wording, which classes the flaw as critical. The CVSS 3.1 base score of 6.3 is what we use for severity.
Is a fixed firmware available?
The record names none. Check D-Link's support page for the model and for any end of life notice.
Sources
- https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_44/44.md (listed in the CVE record)
- https://vuldb.com/?ctiid.311030 (listed in the CVE record)
- https://vuldb.com/?id.311030 (listed in the CVE record)
- https://vuldb.com/?submit.588467 (listed in the CVE record)
- https://www.dlink.com/ (listed in the CVE record)
- Safeguard Gold entry for CVE-2025-5573
Last reviewed: 18 October 2026.
