# CVE-2026-11341: D-Link DWR-M920 OS command injection in formIMEISetup

Source: https://junglewise.ai/threats/cve-2026-11341-d-link-dwr-m920-os-command-injection-in-formimeisetup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-11341 · Severity: medium · CVSS 6.3 · Published 2026-06-05

A security vulnerability has been identified in the D-Link DWR-M920 4G LTE router. This flaw allows a remote attacker with basic user access to execute unauthorized system commands on the device. Successful exploitation could lead to full device takeover, disruption of internet services, or unauthorized access to the local network.

Technologies: [D-Link DWR-M920](https://junglewise.ai/threats/technologies/dwr-m920). Vendors: [D-Link](https://junglewise.ai/threats/vendors/d-link).

## Quick answers

**Is CVE-2026-11341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11341 being exploited in the wild.

**How severe is CVE-2026-11341?** Medium severity, with a CVSS score of 6.3, published 5 June 2026.

**Which products and versions are affected?** D-Link DWR-M920 up to 1.1.50.

**Is there a fix for CVE-2026-11341?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11341 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11341?** Check whether you run D-Link DWR-M920 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the D-Link DWR-M920 router up to version 1.1.50. The flaw is located within the sub_412DA0 function of the /boafrm/formIMEISetup component. The vulnerability stems from improper neutralization of the IMEI_value argument, which allows an attacker to inject and execute arbitrary shell commands. While the attack can be initiated remotely over the network, it requires low-level authentication (PR:L). Public exploit code has been disclosed, increasing the risk of exploitation.

## Affected products

- D-Link DWR-M920 up to 1.1.50

## Timeline

- 2026-06-05: disclosed: Vulnerability published by VulDB/NVD

## References

- [https://github.com/7u7777/Dlink/blob/DWR-M920/formIMEISetup.md](https://github.com/7u7777/Dlink/blob/DWR-M920/formIMEISetup.md)
- [https://vuldb.com/cve/CVE-2026-11341](https://vuldb.com/cve/CVE-2026-11341)
- [https://vuldb.com/submit/832593](https://vuldb.com/submit/832593)
- [https://vuldb.com/vuln/368882](https://vuldb.com/vuln/368882)
- [https://vuldb.com/vuln/368882/cti](https://vuldb.com/vuln/368882/cti)
- [https://www.dlink.com/](https://www.dlink.com/)

## Related threats

- [D-Link DWR-M920 OS command injection in formPinManageSetup](https://junglewise.ai/threats/cve-2026-90699-d-link-dwr-m920-os-command-injection-in-formpinmanagesetup)
- [D-Link DWR-M920 command injection in formUSSDSetup](https://junglewise.ai/threats/cve-2026-11339-d-link-dwr-m920-command-injection-in-formussdsetup)
- [D-Link DWR-M920 command injection in formSmsManage](https://junglewise.ai/threats/cve-2026-10878-d-link-dwr-m920-command-injection-in-formsmsmanage)