Description
A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing manipulation can lead to improper verification of cryptographic signature. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
Affected products
dlink: dap-2695 firmware; dlink: dap-2695
References5
- github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DAP-2695_… ExploitThird Party Advisory
- vuldb.com/?ctiid.329963 Permissions RequiredVDB Entry
- vuldb.com/?id.329963 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.675854 Third Party AdvisoryVDB Entry
- www.dlink.com/ Product
Metrics
- CVSS 3.1
-
8.1
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
6.6
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 39 · as of 10 November 2026
- CWE
- CWE-345CWE-347
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.