Executive brief
The D-Link DWR-M920 is a wireless router used in home and small office networks. A vulnerability in its web management interface allows an authenticated attacker to inject arbitrary system commands through a PIN management feature, leading to complete compromise of the device including the ability to read and modify network traffic, disable security features, or launch attacks on connected networks.
Technical details
This is an OS command injection vulnerability (CWE-78) in the formPinManageSetup handler function (sub_41E60C) of the D-Link DWR-M920 firmware. The newPin parameter is passed directly into a system() call via sprintf without any validation or sanitization. An attacker can break out of single quotes using a single-quote character to inject arbitrary shell commands executed as root. The vulnerability requires prior authentication (webuicookie session) via the web interface, and successful exploitation allows remote code execution as the root user. Patches or vendor guidance are not mentioned in the advisory; the recommended fix is to validate input against a strict whitelist (4–8 digits only) or replace system() with a parameterized execution API.
Affected products
- D-Link DWR-M920 1.1.7 (and 1.1.50, 1.1.70 confirmed vulnerable)
Timeline
- 2026-08-05: disclosed: Vulnerability disclosed on GitHub
- 2026-09-14: advisory: CVE-2026-90699 published