CVE-2026-10878

A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.

A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

D-Link DWR-M920 up to version 1.1.50 has a buffer overflow vulnerability in the function sub_423848 in /boafrm/formParentControl. Manipulation of the submit-url argument results in buffer overflow. The attack can be carried out remotely, and the exploit is now public.

A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. The function sub_42261C in file /boafrm/formFilter is affected. Manipulation of the ip6addr argument results in a stack-based buffer overflow. The attack can be launched remotely and the exploit has been publicly released.

A vulnerability was identified in D-Link DWR-M920 up to 1.1.50. The function sub_464794 in file /boafrm/formDefRoute is affected. Manipulation of the submit-url argument leads to a buffer overflow. The attack can be initiated remotely and the exploit is publicly available.

A weakness has been identified in D-Link DWR-M920 1.1.50 affecting the function sub_41C7FC in /boafrm/formPinManageSetup. Manipulation of the submit-url argument causes a buffer overflow, and the attack can be initiated remotely. The exploit has been made publicly available and could be exploited.