CVE-2026-90702
Received Received - Intake

Command Injection in D-Link DWR-M921 Router

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90702
EUVD
EUVD-2026-77343

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
d-link dwr-m921 1.1.52

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in D-Link DWR-M921 routers running firmware version V1.1.52. It exists in the /boafrm/formDiskFormat endpoint of the web interface where the partition parameter is manipulated to inject arbitrary commands. Attackers can execute remote commands as root after authentication by using semicolons in the parameter, such as sdb;CMD;. The flaw occurs due to lack of input validation and unsafe string concatenation in system calls.

Detection Guidance

To detect this vulnerability, check if your D-Link DWR-M921 router is running firmware version V1.1.52. Inspect network traffic for requests to the /boafrm/formDiskFormat endpoint with a partition parameter containing semicolons or commands. Use curl to test: curl -v 'http://<router-ip>/boafrm/formDiskFormat?partition=sdb;id;'

Verify if a file is created at /tmp/pwned.txt after sending the test command. Ensure session cookies are present in requests.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the router with root privileges after obtaining a valid session cookie. This could lead to full system compromise, data theft, unauthorized access to network resources, or disruption of router services. Attackers may install malware, modify router settings, or pivot to other systems on the network.

Compliance Impact

This vulnerability allows remote command injection, which could lead to unauthorized access to sensitive data stored on the device. For GDPR, this may result in a data breach requiring notification under Article 33. For HIPAA, it could compromise protected health information if the router is used in a healthcare environment.

Mitigation Strategies

Immediately update the router firmware to a patched version if available. Disable remote access to the web interface if not required. Implement network segmentation to isolate the router from critical systems.

Block external access to the /boafrm/formDiskFormat endpoint via firewall rules. Monitor logs for suspicious requests to this endpoint. Consider replacing the device if no patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart