CVE-2025-15189

A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.

A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

A command injection vulnerability was found in D-Link DWR-M920 router versions 1.1.50 and 1.1.70 in the sub_41C8E8 function of the /boafrm/formSmsManage file. Manipulating the action_value argument allows remote code execution. The exploit is publicly available.

D-Link DWR-M920 up to version 1.1.50 has a buffer overflow vulnerability in the function sub_423848 in /boafrm/formParentControl. Manipulation of the submit-url argument results in buffer overflow. The attack can be carried out remotely, and the exploit is now public.

A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. The function sub_42261C in file /boafrm/formFilter is affected. Manipulation of the ip6addr argument results in a stack-based buffer overflow. The attack can be launched remotely and the exploit has been publicly released.