D-Link DWR-M920 CVE-2026-10878

Authentication is required: the CVSS vector specifies PR:L (low privileges required), meaning the attacker must hold a valid low-privilege session on the device's web management interface before exploitation is possible. The vulnerable endpoint /boafrm/formSmsManage must be accessible - if the web management interface is restricted to LAN-only access (a recommended but non-default hardening step on many deployments), WAN-side exploitation is blocked. No user interaction is required (UI:N), and no special network positioning beyond reaching the management port is needed (AV:N/AC:L/AT:N). Exploitation is limited to firmware versions 1.1.50 and 1.1.70 of the DWR-M920; other D-Link models are not confirmed affected by this specific CVE. The SMS management feature (formSmsManage) must be functional on the device, which is expected on LTE router models where SMS handling is a core function.

The CVSS 4.0 base score of 2.1 appears significantly understated relative to the nature of the vulnerability. Command injection is a critical primitive, yet the scoring reflects uniformly Low impact values (VC:L/VI:L/VA:L) with no subsequent-system impact, which is consistent with the limited data sensitivity profile of a consumer router but potentially underestimates the risk of full device compromise, firmware persistence, or use of the router as a pivot point in a network. The E:P modifier in the CVSS vector confirms a proof-of-concept exists, corroborated by the GitHub reference. KEV status is not confirmed, meaning active exploitation by threat actors has not been officially reported by CISA. Attack complexity is Low (AC:L) with no additional triggers (AT:N), making exploitation straightforward for anyone holding a valid low-privilege session. The primary limiting factor is PR:L - the attacker must be authenticated. On consumer routers with default or weak credentials, this constraint is frequently bypassed in practice. EPSS data is not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. Overall: the raw CVSS score is misleading; real-world risk is meaningfully elevated by the public PoC, network accessibility, and the historically poor credential hygiene on consumer D-Link devices.

An attacker with access to a low-privilege account on the D-Link DWR-M920 web management interface - whether via default credentials, credential reuse, or prior compromise - submits a crafted HTTP POST request to /boafrm/formSmsManage with a malicious action_value parameter containing shell metacharacters (e.g., action_value=test;id;). The Boa server passes this value unsanitized to sub_41C8E8, which executes the injected command as part of the router's OS-level process. A public PoC on GitHub documents the exact request structure, making this trivially reproducible by low-skill attackers.