Is there a public PoC exploit available for CVE-2026-11339?

Yes, a public proof-of-concept exploit is available for CVE-2026-11339. Prioritise patching immediately. EPSS: 0.4%.

D-Link DWR-M920 CVE-2026-11339

Q: What is the CVSS score of CVE-2026-11339?

CVE-2026-11339 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-34859 LOW

Command Injection (CWE-77)

2026-06-05 VulDB

GHSA-p9xf-9grr-8jfx

D-Link Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 05, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Jun 05, 2026 - 17:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 05, 2026 - 17:16 vuln.today

DescriptionCVE.org

A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

AnalysisAI

Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows remote authenticated attackers to execute arbitrary OS commands via the ussdValue parameter of the /boafrm/formUSSDSetup endpoint, processed by the vulnerable sub_41CF20 function without input sanitization. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms remote, low-complexity exploitation requiring only low-privilege credentials - a realistic threshold on consumer routers commonly deployed with default or weak passwords. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk above what the moderate CVSS score of 6.3 suggests; no public exploit identified at time of analysis maps to confirmed active exploitation (not in CISA KEV).

Technical ContextAI

The D-Link DWR-M920 is a consumer-grade mobile Wi-Fi router supporting USSD (Unstructured Supplementary Service Data), a GSM/mobile protocol used to communicate configuration commands to cellular carriers. The web management endpoint /boafrm/formUSSDSetup exposes USSD configuration to authenticated users, and the underlying C function sub_41CF20 constructs a system command incorporating the user-supplied ussdValue argument without neutralizing shell metacharacters. This is a classic CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw - distinct from CWE-78 in that the injection occurs at the command construction layer rather than via OS shell invocation, though in practice the effect is equivalent: arbitrary command execution. The CPE cpe:2.3:a:d-link:dwr-m920:*:*:*:*:*:*:*:* with the wildcard version field indicates all tracked firmware versions through 1.1.50 are within scope. The BoaHTTP web server is the typical management interface for this class of D-Link device, and form handlers like boafrm are a known attack surface in embedded router firmware.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CVSS remediation level is undefined (RL:X) and no patched firmware version is referenced in any available source, including the D-Link vendor site (https://www.dlink.com/). Administrators should monitor D-Link's security advisories for firmware updates. As immediate compensating controls: restrict access to the router's web management interface so only explicitly trusted accounts can authenticate - removing or disabling any guest or default accounts eliminates the low-privilege credential vector (PR:L). If remote management is enabled, disable it and confine access to the local LAN segment, reducing the network attack surface (AV:N). Network-level access controls such as firewall rules blocking inbound access to the management port further limit exposure. Note that restricting management access may impact legitimate administrative workflows. VulDB tracking is available at https://vuldb.com/vuln/368881 and the PoC details are published at https://github.com/7u7777/Dlink/blob/DWR-M920/formUSSDSetup.md.