CVE-2026-90699

A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

A command injection vulnerability was found in D-Link DWR-M920 router versions 1.1.50 and 1.1.70 in the sub_41C8E8 function of the /boafrm/formSmsManage file. Manipulating the action_value argument allows remote code execution. The exploit is publicly available.

D-Link DWR-M920 up to version 1.1.50 has a buffer overflow vulnerability in the function sub_423848 in /boafrm/formParentControl. Manipulation of the submit-url argument results in buffer overflow. The attack can be carried out remotely, and the exploit is now public.

A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. The function sub_42261C in file /boafrm/formFilter is affected. Manipulation of the ip6addr argument results in a stack-based buffer overflow. The attack can be launched remotely and the exploit has been publicly released.

A vulnerability was identified in D-Link DWR-M920 up to 1.1.50. The function sub_464794 in file /boafrm/formDefRoute is affected. Manipulation of the submit-url argument leads to a buffer overflow. The attack can be initiated remotely and the exploit is publicly available.

A weakness has been identified in D-Link DWR-M920 1.1.50 affecting the function sub_41C7FC in /boafrm/formPinManageSetup. Manipulation of the submit-url argument causes a buffer overflow, and the attack can be initiated remotely. The exploit has been made publicly available and could be exploited.