Executive brief
A security vulnerability exists in the D-Link DWR-M920 4G LTE router, a device used to provide internet connectivity in homes and small offices. An attacker can exploit this flaw to take control of the device's operating system by sending specially crafted commands through the router's web management interface. This could lead to unauthorized access to network traffic, disruption of internet services, or the use of the router as a foothold for further attacks on the internal network.
Technical details
A command injection and stack-based buffer overflow vulnerability exists in the D-Link DWR-M920 router within the '/boafrm/formUSSDSetup' endpoint. The vulnerability is located in function 'sub_41CF20', where the 'ussdValue' parameter is retrieved from a POST request and passed to 'sprintf' and subsequently 'system()' without adequate sanitization or length checking. An attacker with low-privileged access to the web interface can escape the intended shell command context using single quotes and semicolons (e.g., '; [command] #') to execute arbitrary OS commands. The lack of bounds checking on the same parameter also enables a stack-based buffer overflow. The exploit is publicly disclosed and affects versions up to 1.1.50 and 1.1.70.
Affected products
- D-Link DWR-M920 up to 1.1.50, 1.1.70
Timeline
- 2026-06-05: disclosed: Public disclosure of the vulnerability and exploit code.
- 2026-06-05: advisory: NVD/VulDB advisory published.