DCS-932L

DCS-932L
Security Grade F Calculator v1	DCS-932L Brand: D-Link Category: Indoor Wi-Fi IP network camera (VGA MJPEG, mydlink cloud) • Model / Gen: DCS-932L (Hardware Rev A1/B1; CVE-2025-4842 scoped to firmware 2.18.01) Release Date: 2010-09-30 • Status: End of life Classification Date: 2026-10-23 • [www.dlink.com/cz/cs/products/dcs-932l-day-night-cloud-camera Official Website]

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[legacyfiles.us.dlink.com/DCS-932L/REVB/DCS-932L_REVB_DATASHEET_1.00_EN.PDF 🔗 Proof]	documentary assessment, NOT device testing: datasheet documents only a factory Reset button and no tamper enclosure/seal; physical-hardware tampering exposure is not commonly documented for this consumer model (Rev B1 datasheet scope).
Known vulnerabilities	Very common	[nvd.nist.gov/vuln/detail/CVE-2025-4842 🔗 Proof]	documentary assessment, NOT device testing: NVD records CVE-2025-4842 remote stack-based buffer overflow in /sbin/ucp CameraName on DCS-932L firmware 2.18.01 (CVSS 3.1 9.8 Critical, public exploit); the 2016 Senr.io DCP-protocol family also lists DCS-932L (see D-Link advisory), so known-vulnerability exposure is frequent within the supported firmware range.
Prior attacks	Rare	[threatpost.com/d-link-wi-fi-camera-flaw-extends-to-120-products/119097/ 🔗 Proof]	documentary assessment, NOT device testing: Senrio/Senr.io research and vendor advisories disclose flaws and PoCs, but no publicly documented large-scale in-the-wild compromise campaign attributed specifically to the DCS-932L; assessment limited to documented disclosures for A1/B1 hardware.
Updatability	None	[www.dlink.com/cz/cs/products/dcs-932l-day-night-cloud-camera 🔗 Proof]	documentary assessment, NOT device testing: official product page labels DCS-932L End of Life; CVE-2025-4842 states it only affects products no longer supported by the maintainer, and the D-Link forum thread is filed under "Products No Longer Supported" with last firmware in 2011; no security patch exists for firmware 2.18.01.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[support.dlink.com.au/downloads/product/DCS-932L/Manuals/DCS-932L_A1_Manual_v1.10(WW).pdf 🔗 Proof]	documentary assessment, NOT device testing: remote viewing requires a paired mydlink cloud account, but the local web configuration interface remains independently reachable on the LAN without that account; integration with other systems is therefore partial (manual A1 v1.10 scope).
Communications	No encryption	[legacyfiles.us.dlink.com/DCS-932L/REVB/DCS-932L_REVB_DATASHEET_1.00_EN.PDF 🔗 Proof]	documentary assessment, NOT device testing: datasheet lists an HTTP server and MJPEG/JPEG streaming with no HTTPS/TLS on the local management/streaming path; wireless association supports WEP/WPA/WPA2 but device-to-web-interface traffic is plaintext (Rev B1 datasheet scope).
Storage	No encryption	[legacyfiles.us.dlink.com/DCS-932L/REVB/DCS-932L_REVB_DATASHEET_1.00_EN.PDF 🔗 Proof]	documentary assessment, NOT device testing: datasheet records playback/recording to PC/NAS via D-ViewCam with no onboard encrypted-at-rest store or encryption feature documented (Rev B1 datasheet scope).
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	[support.dlink.com.au/downloads/product/DCS-932L/Manuals/DCS-932L_A1_Manual_v1.10(WW).pdf 🔗 Proof]	documentary assessment, NOT device testing: Maintenance>Admin allows one administrator plus up to 8 added user accounts and a User Access Control toggle, with no roles, groups or lifecycle policy (manual A1 v1.10 scope).
Authentication	Basic	[support.dlink.com.au/downloads/product/DCS-932L/Manuals/DCS-932L_A1_Manual_v1.10(WW).pdf 🔗 Proof]	documentary assessment, NOT device testing: single-factor username/password login to the web interface over HTTP; no MFA, certificate or hardware token (manual A1 v1.10 scope).
Brute-force protection	Absent	[support.dlink.com.au/downloads/product/DCS-932L/Manuals/DCS-932L_A1_Manual_v1.10(WW).pdf 🔗 Proof]	documentary assessment, NOT device testing: manual documents no login lockout, throttling or captcha; no brute-force protection feature is described (manual A1 v1.10 scope).
Event logging	Partial logging	[legacyfiles.us.dlink.com/DCS-932L/REVB/DCS-932L_REVB_DATASHEET_1.00_EN.PDF 🔗 Proof]	documentary assessment, NOT device testing: device supports status/motion alerting but the manual/datasheet document no comprehensive access-audit trail; only partial event recording (Rev B1 datasheet scope).
Passwords	Default/Common/Easy to guess	[support.dlink.com.au/downloads/product/DCS-932L/Manuals/DCS-932L_A1_Manual_v1.10(WW).pdf 🔗 Proof]	documentary assessment, NOT device testing: official manual states that if no password is created in the wizard the default login is username admin with a blank password; no forced-change or complexity requirement on first boot (manual A1 v1.10 scope).
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Proprietary embedded firmware (GoAhead HTTP webserver; Linux-based) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass: