CVE-2026-90706
Received Received - Intake

Command Injection in D-Link DWR-M921 Router

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90706
EUVD
EUVD-2026-77362

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
d-link dwr-m921 1.1.52

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in D-Link DWR-M921 routers running firmware version V1.1.52. It exists in the /boafrm/formWsc endpoint where the targetAPSsid parameter is improperly sanitized. Attackers can inject malicious commands that execute with root privileges by manipulating this parameter.

Detection Guidance

To detect this vulnerability, check if your D-Link DWR-M921 router is running firmware version V1.1.52. You can verify this by logging into the router's admin panel and checking the firmware version under system settings. Additionally, monitor network traffic for POST requests to the /boafrm/formWsc endpoint with unusual parameters like targetAPSsid containing command injection patterns such as $(CMD).

Commands to check for vulnerable endpoints include: curl -X POST http://<router-ip>/boafrm/formWsc -d 'targetAPSsid=$(whoami)' to test for command execution. If the response includes the output of the command, the system is vulnerable.

Impact Analysis

An attacker could gain full control of your router by exploiting this vulnerability. This includes accessing sensitive data, modifying network settings, installing malware, or using the device as a pivot point to attack other systems on your network. The attack requires authentication but can be performed remotely.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA. If attackers gain access to personal or health data through the compromised router, organizations may face regulatory fines and legal consequences for failing to maintain adequate security controls.

Mitigation Strategies

Immediately update the router's firmware to the latest version provided by D-Link. If no update is available, disable remote administration and WPS features to reduce attack surface. Implement strict input validation for the targetAPSsid parameter and block requests containing suspicious characters like $, (, ), ;, or command injection patterns.

Restrict access to the router's admin panel to trusted networks only. Monitor logs for unauthorized access attempts or unusual activity. Consider replacing the device if the vendor does not provide a patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart