Is CVE-2026-90702 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90702 being exploited in the wild.

How severe is CVE-2026-90702?

Critical severity, with a CVSS score of 9.1, published 14 September 2026.

Is there a fix for CVE-2026-90702?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90702 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-90702?

Check whether you run D-Link DWR-M921 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90702: D-Link DWR-M921 OS command injection in /boafrm/formDiskFormat

CVE-2026-90702 · Severity: critical · CVSS 9.1 · Published 2026-09-14

The D-Link DWR-M921 is a wireless router used to provide internet connectivity and network management. A flaw in its disk formatting feature allows authenticated attackers to inject and execute arbitrary system commands with root privileges on the device. An attacker with web access could gain complete control of the router, potentially intercepting or manipulating all network traffic.

Technologies: D-Link DWR-M921. Vendors: D-Link.

Quick answers

Is CVE-2026-90702 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90702 being exploited in the wild.
How severe is CVE-2026-90702?: Critical severity, with a CVSS score of 9.1, published 14 September 2026.
Which products and versions are affected?: D-Link DWR-M921 1.1.52.
Is there a fix for CVE-2026-90702?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90702 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-90702?: Check whether you run D-Link DWR-M921 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an OS command injection vulnerability (CWE-78) in the /boafrm/formDiskFormat handler of the D-Link DWR-M921 firmware. The vulnerable code concatenates the user-supplied "partition" parameter directly into system() calls without sanitization or quoting, allowing semicolon-based command injection. An authenticated attacker can exploit this via a POST request by supplying a malicious partition value (e.g., "sdb;malicious_command;") to execute arbitrary commands as root. The vulnerability requires a valid web UI session (webuicookie) but is remotely reachable. No patch information is currently available.

Affected products

D-Link DWR-M921 1.1.52

Timeline

2026-09-14: disclosed
exploited: Exploit published on GitHub; not yet reported in active wild exploitation as of advisory date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.