D-Link DWR-M920 CVE-2026-11341

Exploitation requires authenticated access to the DWR-M920 web management interface - the CVSS vector PR:L confirms that low-privilege credentials (such as a standard user or operator account, not necessarily full admin) are sufficient. The attacker must be able to reach the /boafrm/formIMEISetup endpoint over the network (AV:N), meaning the management interface must be reachable from the attacker's position (WAN-facing or LAN). The IMEI setup feature on the formIMEISetup endpoint must be accessible to the authenticated session. No user interaction is required beyond the attacker's own actions (UI:N). Exploitation is limited by the need for valid credentials - brute force, credential reuse, or default password exploitation would be the prerequisite step for external attackers. There is no indication of a non-default configuration requirement beyond having a reachable management interface.

The CVSS 6.3 Medium score reflects the required low-privilege authentication (PR:L) as the primary risk-reducing factor - without it, this would score considerably higher. The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), meaning exploitation is straightforward once authenticated credentials are obtained. Scope is unchanged (S:U), with partial confidentiality, integrity, and availability impact (C:L/I:L/A:L). The CVSS temporal modifiers E:P (Proof-of-Concept exploit exists) and RC:R (reasonable confidence in reporting) elevate practical concern. No EPSS score was provided in the source data, so probability-based prioritization cannot be performed at this time. The device is not listed in the CISA KEV catalog, meaning mass exploitation has not been confirmed, but the publicly available GitHub PoC significantly lowers the barrier for opportunistic attackers targeting exposed router admin panels. For organizations with internet-facing DWR-M920 management interfaces, the real-world risk is materially higher than the base score implies. The RL:X temporal modifier (remediation level not defined) combined with the absence of a confirmed vendor patch further compounds exposure.

An attacker who has obtained or guessed low-privilege credentials to the DWR-M920 web interface sends a crafted HTTP POST request to /boafrm/formIMEISetup with a malicious IMEI_value field containing shell metacharacters (e.g., a semicolon followed by a reverse shell payload). The unsanitized input is passed to function sub_412DA0, which executes the injected command in the router's OS context. A publicly available PoC on GitHub documents the precise request structure, enabling even low-skill attackers to replicate the technique against internet-exposed devices.