CVE-2025-15191
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
Risk Assessment
An attacker can remotely execute arbitrary commands on the router, potentially leading to full control of the device and network.
Recommendation
Apply firmware updates from the vendor or restrict access to the device from trusted networks.
Other vulnerabilities in D-Link DWR-M920
See all- CVE-2026-90699Critical
A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.
- CVE-2026-10878Medium
A command injection vulnerability was found in D-Link DWR-M920 router versions 1.1.50 and 1.1.70 in the sub_41C8E8 function of the /boafrm/formSmsManage file. Manipulating the action_value argument allows remote code execution. The exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS