CVE-2026-108971

{
  "etk_id": "ETK-2026-1457",
  "cve_id": "CVE-2026-108971",
  "display_id": "CVE-2026-108971",
  "ghsa_id": "GHSA-5vhf-mw8w-298v",
  "euvd_id": "EUVD-2026-98294",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper firmware signature verification in D-Link DCS-930L",
  "summary": "D-Link DCS-930L devices running B1.08B4 have an improper firmware signature verification issue in the Emergency HTTP Recovery Server. A remote attacker who can reach that recovery service may be able to cause it to accept firmware without proper signature validation.",
  "mitigation": "Restrict network access to the Emergency HTTP Recovery Server and allow firmware recovery actions only from trusted administrative networks. Do not expose the device or its recovery interface directly to untrusted networks, and obtain vendor-supported updated firmware when available.",
  "vendor": "D-Link",
  "product": "DCS-930L",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "B1.08B4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "DCS-930L",
      "purl": null
    }
  ],
  "cwes": [
    347
  ],
  "cvss_score": 9.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
  "epss_score": 0.0023,
  "epss_percentile": 0.1241,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.123161066666666,
  "t0_at": "2026-10-13T05:45:16.733000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-13T05:45:16.733000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T05:45:16.733000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108971"
    }
  }
}