Critical severity · published Sep 14, 2026
CVE-2026-90699
D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection
9.9
CVSS
3.3%
EPSS
No
On KEV
Description
A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DW
DWR-M920 · D-Link
1.1.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90699
github.com
https://github.com/H3rmesk1t/vulnerability-paper/issues/9
vuldb.com
https://vuldb.com/cve/CVE-2026-90699
vuldb.com
https://vuldb.com/submit/916259
vuldb.com
https://vuldb.com/vuln/403232
vuldb.com
https://vuldb.com/vuln/403232/cti
www.dlink.com
https://www.dlink.com/
More from DWR-M920
8.8
CVE-2026-11339
D-Link DWR-M920 formUSSDSetup sub_41CF20 command injection
8.8
CVE-2026-10878
D-Link DWR-M920 formSmsManage sub_41C8E8 command injection
6.3
CVE-2026-11341
D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection