Vulnerability · Published Sep 14, 2026 · Assigned by VulDB
CVE-2026-90704D-Link DWR-M921 formDiskPartition system command injection
Medium 6.6
In plain English
A medium-severity command injection in DWR-M921 from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)2.3%top 16.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-403246 | D-Link DWR-M921 formDiskPartition system command injection vdb-entry, technical-description
- VDB-403246 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-90704 | CVE Analysis and Report third-party-advisory
- Submit #917696 | D-Link Router D-Link DWR-M921 V1.1.52 Command Injection third-party-advisory
- https://gist.github.com/H3rmesk1t/2052767b9fb397e311c17383a0e19021 exploit
- https://www.dlink.com/ product