Executive brief
The D-Link DWR-M921 is a wireless router used to provide internet connectivity and network management. A flaw in its disk formatting feature allows authenticated attackers to inject and execute arbitrary system commands with root privileges on the device. An attacker with web access could gain complete control of the router, potentially intercepting or manipulating all network traffic.
Technical details
This is an OS command injection vulnerability (CWE-78) in the /boafrm/formDiskFormat handler of the D-Link DWR-M921 firmware. The vulnerable code concatenates the user-supplied "partition" parameter directly into system() calls without sanitization or quoting, allowing semicolon-based command injection. An authenticated attacker can exploit this via a POST request by supplying a malicious partition value (e.g., "sdb;malicious_command;") to execute arbitrary commands as root. The vulnerability requires a valid web UI session (webuicookie) but is remotely reachable. No patch information is currently available.
Affected products
- D-Link DWR-M921 1.1.52
Timeline
- 2026-09-14: disclosed
- exploited: Exploit published on GitHub; not yet reported in active wild exploitation as of advisory date