Executive brief
The D-Link DWR-M921 wireless router contains a command injection vulnerability in its disk partition management functionality. An authenticated attacker can craft a specially formatted request to execute arbitrary system commands with root privileges, potentially compromising the entire device and any data stored on it.
Technical details
A command injection vulnerability exists in the /boafrm/formDiskPartition handler of D-Link DWR-M921 firmware v1.1.52. The vulnerable code unsafely concatenates user-controlled input (the "devicename" parameter) into shell commands executed via system(), without quoting or filtering shell metacharacters. An authenticated attacker can inject shell commands using semicolon separators in the devicename parameter, leading to arbitrary command execution as root. The attack requires valid authentication (webuicookie session) and is remotely accessible via the web interface. No patches are currently available.
Affected products
- D-Link DWR-M921 1.1.52
Timeline
- 2026-09-14: disclosed: Vulnerability publicly disclosed with proof-of-concept
- 2026-08-06: other: GitHub gist published with technical details