Is CVE-2026-90706 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90706 being exploited in the wild.

How severe is CVE-2026-90706?

Medium severity, with a CVSS score of 6.6, published 14 September 2026.

Is there a fix for CVE-2026-90706?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90706 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-90706?

Check whether you run D-Link DWR-M921 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90706: D-Link DWR-M921 OS command injection in formWsc

CVE-2026-90706 · Severity: medium · CVSS 6.6 · Published 2026-09-14

The D-Link DWR-M921 wireless router contains a command injection vulnerability in its web management interface. An authenticated attacker can inject arbitrary shell commands through an improperly sanitized parameter, allowing them to execute commands with root privileges on the device. This could lead to complete compromise of the router, exposing or intercepting all network traffic passing through it.

Technologies: D-Link DWR-M921. Vendors: D-Link.

Quick answers

Is CVE-2026-90706 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90706 being exploited in the wild.
How severe is CVE-2026-90706?: Medium severity, with a CVSS score of 6.6, published 14 September 2026.
Which products and versions are affected?: D-Link DWR-M921 1.1.52.
Is there a fix for CVE-2026-90706?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90706 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-90706?: Check whether you run D-Link DWR-M921 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) in the formWsc handler at address 0x45A5A0 within /bin/boa. The targetAPSsid parameter is filtered by sub_43B224, which only escapes backslash, double-quote, and backtick characters, leaving shell metacharacters ($, parentheses, semicolon) unfiltered. An attacker with a valid session cookie can inject commands using $(...) command substitution syntax within the double-quoted iwpriv command. The attack requires authentication via webuicookie but is otherwise remotely exploitable. Proof-of-concept code is publicly available on GitHub; patches or firmware updates have not been confirmed.

Affected products

D-Link DWR-M921 1.1.52

Timeline

2026-08-06: disclosed: Vulnerability disclosed on GitHub gist
2026-09-14: advisory: CVE-2026-90706 published on NVD
2026-09-14: other: Public exploit code available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.