Medium severity · published Sep 14, 2026
CVE-2026-90706
D-Link DWR-M921 formWsc os command injection
6.6
CVSS
2.3%
EPSS
No
On KEV
Description
A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DW
DWR-M921 · D-Link
1.1.52 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90706
gist.github.com
https://gist.github.com/H3rmesk1t/f2d1f9115192b7af18699a8214a5b7ad
vuldb.com
https://vuldb.com/cve/CVE-2026-90706
vuldb.com
https://vuldb.com/submit/917698
vuldb.com
https://vuldb.com/vuln/403248
vuldb.com
https://vuldb.com/vuln/403248/cti
www.dlink.com
https://www.dlink.com/
More from DWR-M921
9.1
CVE-2026-90703
D-Link DWR-M921 formDiskCreateShare system os command injection
9.1
CVE-2026-90702
D-Link DWR-M921 formDiskFormat system os command injection
8.8
CVE-2026-2169
D-Link DWR-M921 formLtefotaUpgradeFibocom command injection
8.8
CVE-2026-2168
D-Link DWR-M921 formLtefotaUpgradeQuectel sub_419920 command injection
7.2
CVE-2026-2085
D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection