Executive brief
The D-Link DWR-M921 router firmware contains a command injection vulnerability in a hidden web interface handler. An authenticated attacker can inject arbitrary shell commands that execute with root privileges on the device, leading to complete compromise of the router, including potential compromise of all connected network traffic and devices.
Technical details
The vulnerability is an OS command injection (CWE-78) in the formSysCmd handler at /boafrm/formSysCmd within the Boa web server dispatch table. The sysCmd parameter is retrieved without any sanitization or validation and passed directly to a system() call via snprintf, allowing injection of shell metacharacters (semicolons, pipes, ampersands, command substitution). The attack requires prior authentication (default credentials admin/admin) via a webuicookie session, but no user interaction beyond a POST request to an undocumented endpoint. An attacker can execute arbitrary commands with root privileges, read/write files, and fully compromise the device. The handler exists only in firmware version 1.1.52 and has not been patched in known updates.
Affected products
- D-Link DWR-M921 1.1.52
Timeline
- 2026-08-06: disclosed: Vulnerability publicly disclosed via GitHub gist
- 2026-09-14: advisory: CVE-2026-90705 published