Vulnerability · Published Sep 14, 2026 · Assigned by VulDB
CVE-2026-90705D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection
Medium 6.6
In plain English
A medium-severity OS command injection in DWR-M921 from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)2.3%top 16.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-403247 | D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection vdb-entry, technical-description
- VDB-403247 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-90705 | CVE Analysis and Report third-party-advisory
- Submit #917697 | D-Link Router D-Link DWR-M921 V1.1.52 Command Injection third-party-advisory
- https://gist.github.com/H3rmesk1t/42bca7c81530b8419811ddcbd39b3b56 exploit
- https://www.dlink.com/ product