Is there a public PoC exploit available for CVE-2026-10878?

Yes, a public proof-of-concept exploit is available for CVE-2026-10878. Prioritise patching immediately. EPSS: 0.4%.

D-Link DWR-M920 CVE-2026-10878

Q: What is the CVSS score of CVE-2026-10878?

CVE-2026-10878 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-34775 LOW

Command Injection (CWE-77)

2026-06-05 VulDB

GHSA-j2q3-mwgw-r24j

D-Link Command Injection Dwr M920

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 00:30 vuln.today

Severity Changed

Jun 05, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

Jun 05, 2026 - 00:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument action_value results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Command injection in D-Link DWR-M920 router firmware versions 1.1.50 and 1.1.70 allows a low-privileged, remote-authenticated attacker to inject OS commands via the action_value parameter in the SMS management endpoint /boafrm/formSmsManage. The vulnerability resides in the C function sub_41C8E8 and stems from unsanitized user input being passed directly to a command interpreter (CWE-77). A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation despite the absence of CISA KEV listing.

Technical ContextAI

The D-Link DWR-M920 is a consumer-grade LTE router running an embedded Linux firmware with a Boa web server handling its management interface. The affected function sub_41C8E8, located within the /boafrm/formSmsManage CGI handler, processes SMS management operations. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates that the action_value argument is concatenated into a shell command or system() call without sanitization, allowing shell metacharacters (e.g., semicolons, pipes, backticks) to break out of the intended command context. CPE cpe:2.3:a:d-link:dwr-m920:*:*:*:*:*:*:*:* confirms all sub-versions of the DWR-M920 product line are considered in scope. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N reflects that no special network positioning or complex conditions are needed beyond holding a low-privilege session on the device.

RemediationAI

No vendor-released patch has been identified at time of analysis. D-Link's advisory page (https://www.dlink.com/) should be monitored for firmware updates addressing CVE-2026-10878. As an immediate compensating control, administrators should restrict access to the router's web management interface to trusted LAN addresses only - disabling remote (WAN-side) management access entirely removes network-accessible exposure, at the cost of losing remote administration capability. Changing the default administrator credentials to a strong, unique password raises the effective barrier against exploitation by preventing credential-based access, though this does not eliminate the vulnerability. If SMS management functionality in /boafrm/formSmsManage is not operationally required, disabling that feature through the router's administration panel is advisable. Network segmentation placing the device on an isolated management VLAN limits lateral movement impact if exploitation occurs. Defenders should consult https://vuldb.com/vuln/368368 and the PoC at https://github.com/7u7777/Dlink/blob/DWR-M920/formSmsManage.md for behavioral indicators to aid detection.