Quick answers
- Is CVE-2026-90705 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90705 being exploited in the wild.
- How severe is CVE-2026-90705?
- Medium severity, with a CVSS score of 6.6, published 14 September 2026.
- Which products and versions are affected?
- D-Link DWR-M921 1.1.52.
- Is there a fix for CVE-2026-90705?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-90705 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-90705?
- Check whether you run D-Link DWR-M921 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an OS command injection (CWE-78) in the formSysCmd handler at /boafrm/formSysCmd within the Boa web server dispatch table. The sysCmd parameter is retrieved without any sanitization or validation and passed directly to a system() call via snprintf, allowing injection of shell metacharacters (semicolons, pipes, ampersands, command substitution). The attack requires prior authentication (default credentials admin/admin) via a webuicookie session, but no user interaction beyond a POST request to an undocumented endpoint. An attacker can execute arbitrary commands with root privileges, read/write files, and fully compromise the device. The handler exists only in firmware version 1.1.52 and has not been patched in known updates.
Affected products
- D-Link DWR-M921 1.1.52
Timeline
- 2026-08-06: disclosed: Vulnerability publicly disclosed via GitHub gist
- 2026-09-14: advisory: CVE-2026-90705 published