Is CVE-2026-90703 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90703 being exploited in the wild.

How severe is CVE-2026-90703?

Critical severity, with a CVSS score of 9.1, published 14 September 2026.

Is there a fix for CVE-2026-90703?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90703 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-90703?

Check whether you run D-Link DWR-M921 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90703: D-Link DWR-M921 OS command injection in formDiskCreateShare

CVE-2026-90703 · Severity: critical · CVSS 9.1 · Published 2026-09-14

D-Link DWR-M921 is a wireless router used to provide internet connectivity in homes and small offices. A critical vulnerability in its web management interface allows authenticated users to execute arbitrary system commands with root privileges by manipulating the folder path parameter in the share creation feature. An attacker with valid router credentials could take complete control of the device, intercept network traffic, or use it as a foothold for attacking connected networks.

Technologies: D-Link DWR-M921. Vendors: D-Link.

Quick answers

Is CVE-2026-90703 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90703 being exploited in the wild.
How severe is CVE-2026-90703?: Critical severity, with a CVSS score of 9.1, published 14 September 2026.
Which products and versions are affected?: D-Link DWR-M921 1.1.52.
Is there a fix for CVE-2026-90703?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90703 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-90703?: Check whether you run D-Link DWR-M921 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) in the /boafrm/formDiskCreateShare handler within the boa web server binary. The folderpath parameter is unsafely concatenated into a mkdir shell command executed via system() without proper sanitization: sprintf(v26, "mkdir %s/\"%s\"", folderpath, foldername); system(v26). Since folderpath is placed outside quotes, an attacker can inject arbitrary commands using semicolon separators (e.g., /mnt/usb;malicious_command;). The vulnerability requires valid web UI authentication (webuicookie session) but executes with root privileges. The foldername parameter (inside quotes) is also exploitable via command substitution syntax $(CMD). Patches should implement strict input validation using whitelists or replace system() calls with safe API equivalents like mkdir().

Affected products

D-Link DWR-M921 1.1.52

Timeline

2026-08-06: disclosed: Vulnerability details published on GitHub
2026-09-14: advisory: NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.