Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
CVE · High CVE-2026-90703 2026-09-14

CVE-2026-90703: OS Command Injection in D-Link DWR-M921 Router

"A publicly disclosed OS command injection flaw in the D-Link DWR-M921 router (version 1.1.52) lets a remote attacker with high privileges execute arbitrary commands through the `folderpath` parameter of the device's…"

A publicly disclosed OS command injection flaw in the D-Link DWR-M921 router (version 1.1.52) lets a remote attacker with high privileges execute arbitrary commands through the folderpath parameter of the device's disk-share endpoint.

What Is It

CVE-2026-90703 is an OS command injection vulnerability (CWE-77, CWE-78) affecting the D-Link DWR-M921 at firmware version 1.1.52. The flaw sits in the system function of the file /boafrm/formDiskCreateShare. Manipulating the folderpath argument passes attacker-controlled input into a command execution path, and the attack may be launched remotely over the network.

The record was published by VulDB ([email protected]) on 2026-09-14 and currently carries an NVD status of "Received," meaning NVD has not yet completed its own analysis. All severity metrics below therefore come from the CNA, not from NVD. The exploit has been disclosed publicly and may already be in use.

Why It Matters

VulDB, as the assigning CNA, rates the flaw at a CVSS v3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, network attack vector, low attack complexity, no user interaction, and a changed scope with complete confidentiality, integrity, and availability impact. The scope change reflects that command execution on the router reaches beyond the vulnerable component itself. A separate CVSS v4.0 assessment from the same source scores 8.5 (HIGH). NVD may publish its own scoring that differs once the record is analyzed.

Exploitation does require high privileges (the CNA's CVSS v2 metrics note multiple authentication instances), which narrows the attacker set. That mitigation is undercut by exploit maturity: the CVSS v4.0 metric rates it PROOF_OF_CONCEPT, and public exploit material is already available.

What's Vulnerable

Patch Status

No patch, fixed version, or vendor advisory has been published for CVE-2026-90703. Operators should watch the D-Link vendor site for firmware updates and, in the interim, restrict network reachability of the device's management interface.

Sources