D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the…

Published 9 y ago 2017-04-24 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

4.3%

percentile 91%

Public exploits

Exploit-DB

D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to *, thus accepting requests from any domain. If a victim logged into the camera's web console visits a malicious site hosting a malicious Flash file from another Browser tab, the malicious Flash file then can send requests to the victim's DCS series Camera without knowing the credentials. An attacker can host a malicious Flash file that can retrieve Live Feeds or information from the victim's DCS series Camera, add new admin users, or make other changes to the device. Known affected devices are DCS-933L with firmware before 1.13.05, DCS-5030L, DCS-5020L, DCS-2530L, DCS-2630L, DCS-930L, DCS-932L, and DCS-932LB1.

Exploit prediction (EPSS)

4.29% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

Exploits and detections

EDB-42074 D-Link DCS Series Cameras - Insecure Crossdomain · webapps · 2017-02-22

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

qualys.com /2017/02/22/qsa-2017-02-22/qsa-2017-02-22.pdf · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2017-7852
NVD: CVE-2017-7852

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary