{"id":"CVE-2017-17020","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-17020","generatedAt":"2026-10-29T01:52:08.888Z","title":"On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with firmware before 1.15.01, command injection in alphapd (binary responsible for running the camera's web server)…","description":"On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with firmware before 1.15.01, command injection in alphapd (binary responsible for running the camera's web server) allows remote authenticated attackers to execute code through sanitized /setSystemAdmin user input in the AdminID field being passed directly to a call to system.","published":"2018-05-01T16:29:00.000Z","lastModified":"2026-06-17T01:10:15.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-78"],"affected":["dlink/dcs-5009 firmware","dlink/dcs-5010 firmware","dlink/dcs-5020l firmware"],"epss":{"score":0.14835,"percentile":0.96673,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.11782,"percentile":0.95945},{"date":"2026-09-22","score":0.14835,"percentile":0.96535}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2018-03-27","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44580,"kind":"exploit","title":"DLINK DCS-5020L - Remote Code Execution (PoC)","url":"https://www.exploit-db.com/exploits/44580","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/hardware/webapps/44580.txt","file":"exploits/hardware/webapps/44580.txt","published":"2018-03-27","added":"2018-05-03","updated":"2022-11-04","author":"Fidus InfoSecurity","type":"webapps","platform":"hardware","port":null,"verified":false,"codes":["CVE-2017-17020"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.fidusinfosec.com/dlink-dcs-5030l-remote-code-execution-cve-2017-17020/"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 14.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10084","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://www.fidusinfosec.com/dlink-dcs-5030l-remote-code-execution-cve-2017-17020/","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10084","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.fidusinfosec.com/dlink-dcs-5030l-remote-code-execution-cve-2017-17020/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-17020","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}