CVE-2026-90699

CriticalCVSS 9.9

Published: 14/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Summary

A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.

Risk Assessment

A remote attacker can execute arbitrary OS commands on the device, potentially leading to full router compromise and network traffic interception. Public availability of the exploit increases the risk of rapid exploitation.

Recommendation

Update D-Link DWR-M920 firmware to a version containing the fix or disable/remove the device from exposure to untrusted networks. Restrict access to the management interface and monitor logs for unusual commands.

Other vulnerabilities in D-Link DWR-M920

CVE-2026-10878Medium
A command injection vulnerability was found in D-Link DWR-M920 router versions 1.1.50 and 1.1.70 in the sub_41C8E8 function of the /boafrm/formSmsManage file. Manipulating the action_value argument allows remote code execution. The exploit is publicly available.

Original NVD description (English source)

A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.