D-Link DCS-2530L and DCS-2670L cameras are subject to active exploitation due to a critical command injection vulnerability that allows attackers to gain full control of the device.

This is a command injection vulnerability located in the cgi-bin/ddns_enc.cgi component of the device firmware. The vulnerability requires the attacker to be authenticated to the device to execute arbitrary commands with high privileges.

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary commands, effectively compromising the integrity, availability, and confidentiality of the surveillance device. Given the CVSS score of 9.5, this is a critical security risk that could allow lateral movement into the internal network or the use of these devices as part of a botnet. Because this vulnerability is currently being exploited in the wild, the potential for unauthorized access and data exfiltration is high.

Immediate Action: Update the firmware for DCS-2530L devices to version 1.07 or later, and for DCS-2670L devices to version 2.03 or later. If these devices are end-of-life and cannot be updated, discontinue their use immediately.

Proactive Monitoring: Monitor device logs for unusual command execution patterns or unexpected outbound network traffic originating from the cameras.

Compensating Controls: Restrict management interface access to trusted administrative IP addresses via firewall rules to prevent unauthorized users from reaching the vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in referenced security research.

Given the confirmed active exploitation and the critical severity of this command injection flaw, immediate action is required. Organizations must verify their device firmware versions and apply the necessary patches. If the hardware is no longer supported by the vendor, decommissioning the devices is the only effective way to eliminate this significant security risk.