CVE-2026-90699
Received Received - Intake

Command Injection in D-Link DWR-M920 Router

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90699
EUVD
EUVD-2026-77331

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
d-link dwr-m920 1.1.7
d-link dwr-m920 1.1.50
d-link dwr-m920 1.1.70

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in D-Link DWR-M920 routers running firmware version 1.1.7. It exists in the /boafrm/formPinManageSetup endpoint where the newPin parameter is passed unsanitized into a sprintf format string, allowing command injection via single-quote breakout. The system() function executes injected commands with root privileges.

Detection Guidance

To detect this vulnerability, check if your D-Link DWR-M920 router is running firmware version V1.1.70 or earlier. Inspect network traffic for POST requests to /boafrm/formPinManageSetup with the operationName parameter set to setPin, cancelPin, or modifyPin. Look for unusual newPin parameter values containing shell metacharacters or commands.

Impact Analysis

An attacker can remotely execute arbitrary commands on your router with root privileges. This allows full device compromise including reading/modifying configurations, intercepting network traffic, disabling security features, or using the router as a launch point for further attacks. The attack requires prior authentication via a valid session cookie.

Compliance Impact

This vulnerability allows remote attackers with valid authentication to execute arbitrary commands with root privileges on the D-Link DWR-M920 router. This could lead to unauthorized access to sensitive data, interception of network traffic, or modification of device configurations, which may violate data protection requirements under GDPR and HIPAA if such data is processed or transmitted through the affected device.

Mitigation Strategies

Immediately update the router firmware to the latest version. Disable remote administration if not needed. Block external access to the /boafrm/formPinManageSetup endpoint via firewall rules. Monitor for suspicious activity or unauthorized file writes in /web/

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart