CVE-2026-1419

low · 2

A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation of the argument LightSensorControl can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS

15.7%

EPSS (exploit prob.)

97th

EPSS percentile

2026-01-26

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
dlink	dcs-700l_firmware	1.03.09
dlink	dcs-700l	all versions

Check a specific version with /api/v1/cve/match.

References

https://tzh00203.notion.site/D-Link-DCS700l-v1-03-09-Command-Injection-Vulnerability-in-LightSensorControl-Parameter-2e6b5c52018a80ada0f6d7e72efd7a45?source=copy_link
https://vuldb.com/?ctiid.342815
https://vuldb.com/?id.342815
https://vuldb.com/?submit.736554
https://www.dlink.com/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-1419