CVE-2017-7852

CVE-2017-7852 describes a critical Cross-Site Request Forgery (CSRF) vulnerability in various D-Link DCS series cameras, including models like the DCS-933L and DCS-5030L, due to an insecure CrossDomain.XML file. This flaw allows malicious Flash objects on external websites to interact with a victim's camera if they are logged into its web console, potentially leading to unauthorized access, configuration changes, or retrieval of live feeds. With a CVSS score of 8.8 (High), the vulnerability is easily exploitable over the network with low complexity and user interaction, enabling high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry (EDB-42074) confirms the existence of public exploit code, though community discussion and media coverage remain minimal.