# CVE-2026-90699: D-Link DWR-M920 OS command injection in formPinManageSetup

Source: https://junglewise.ai/threats/cve-2026-90699-d-link-dwr-m920-os-command-injection-in-formpinmanagesetup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90699 · Severity: critical · CVSS 9.9 · Published 2026-09-14

The D-Link DWR-M920 is a wireless router used in home and small office networks. A vulnerability in its web management interface allows an authenticated attacker to inject arbitrary system commands through a PIN management feature, leading to complete compromise of the device including the ability to read and modify network traffic, disable security features, or launch attacks on connected networks.

Technologies: [D-Link DWR-M920](https://junglewise.ai/threats/technologies/dwr-m920). Vendors: [D-Link](https://junglewise.ai/threats/vendors/d-link).

## Quick answers

**Is CVE-2026-90699 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90699 being exploited in the wild.

**How severe is CVE-2026-90699?** Critical severity, with a CVSS score of 9.9, published 14 September 2026.

**Which products and versions are affected?** D-Link DWR-M920 1.1.7 (and 1.1.50, 1.1.70 confirmed vulnerable).

**Is there a fix for CVE-2026-90699?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90699 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90699?** Check whether you run D-Link DWR-M920 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an OS command injection vulnerability (CWE-78) in the formPinManageSetup handler function (sub_41E60C) of the D-Link DWR-M920 firmware. The newPin parameter is passed directly into a system() call via sprintf without any validation or sanitization. An attacker can break out of single quotes using a single-quote character to inject arbitrary shell commands executed as root. The vulnerability requires prior authentication (webuicookie session) via the web interface, and successful exploitation allows remote code execution as the root user. Patches or vendor guidance are not mentioned in the advisory; the recommended fix is to validate input against a strict whitelist (4–8 digits only) or replace system() with a parameterized execution API.

## Affected products

- D-Link DWR-M920 1.1.7 (and 1.1.50, 1.1.70 confirmed vulnerable)

## Timeline

- 2026-08-05: disclosed: Vulnerability disclosed on GitHub
- 2026-09-14: advisory: CVE-2026-90699 published

## References

- [https://github.com/H3rmesk1t/vulnerability-paper/issues/9](https://github.com/H3rmesk1t/vulnerability-paper/issues/9)
- [https://vuldb.com/cve/CVE-2026-90699](https://vuldb.com/cve/CVE-2026-90699)

## Related threats

- [D-Link DWR-M920 OS command injection in formIMEISetup](https://junglewise.ai/threats/cve-2026-11341-d-link-dwr-m920-os-command-injection-in-formimeisetup)
- [D-Link DWR-M920 command injection in formUSSDSetup](https://junglewise.ai/threats/cve-2026-11339-d-link-dwr-m920-command-injection-in-formussdsetup)
- [D-Link DWR-M920 command injection in formSmsManage](https://junglewise.ai/threats/cve-2026-10878-d-link-dwr-m920-command-injection-in-formsmsmanage)