Is there a public PoC exploit available for CVE-2026-11341?

Yes, a public proof-of-concept exploit is available for CVE-2026-11341. Prioritise patching immediately. EPSS: 0.4%.

D-Link DWR-M920 CVE-2026-11341

Q: What is the CVSS score of CVE-2026-11341?

CVE-2026-11341 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-34860 LOW

OS Command Injection (CWE-78)

2026-06-05 VulDB

GHSA-qf6m-7588-878v

D-Link Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 05, 2026 - 18:22 NVD

MEDIUM LOW

CVSS changed

Jun 05, 2026 - 18:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 05, 2026 - 17:52 vuln.today

DescriptionCVE.org

A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

OS command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary shell commands on the device via the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The vulnerable function sub_412DA0 fails to sanitize attacker-controlled input before passing it to an OS-level command, granting low-privilege network access sufficient to achieve code execution with the confidence of a partial proof-of-concept. A publicly available exploit has been disclosed on GitHub, elevating practical risk beyond the CVSS 6.3 score alone.

Technical ContextAI

The D-Link DWR-M920 is a 4G LTE mobile Wi-Fi router whose web management interface is served by the Boa embedded HTTP server. The affected endpoint /boafrm/formIMEISetup handles IMEI configuration submitted via the IMEI_value POST parameter. The function sub_412DA0 (identified by its binary address, indicating firmware-level analysis) processes this value without adequate input sanitization, passing it directly or through an intermediate buffer into a system() or similar OS command execution call. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw, where metacharacters such as semicolons, pipes, or backticks in the IMEI_value field can break out of the intended command context and inject arbitrary shell instructions. The CPE cpe:2.3:a:d-link:dwr-m920:*:*:*:*:*:*:*:* covers all sub-versions up to 1.1.50 without exception.

RemediationAI

No vendor-released patch has been identified at time of analysis - the D-Link advisory portal (https://www.dlink.com/) should be monitored for firmware updates targeting versions above 1.1.50. As an immediate compensating control, disable remote access to the router's web management interface from the WAN side entirely, which prevents unauthenticated network actors from reaching the vulnerable endpoint even if they later obtain credentials. If LAN-side access cannot be avoided, restrict management interface access to specific trusted IP addresses using the router's access control list features, noting this does not prevent insider or pivot-based attacks. Changing default administrative credentials reduces the risk from credential-stuffing attacks that would enable exploitation (PR:L requires authenticated access). Network-level filtering of HTTP/HTTPS traffic to the management port (typically 80/443 or a custom port) via an upstream firewall is a further layer. Full isolation of the device behind a management VLAN with strict egress filtering limits blast radius if exploitation occurs. The PoC is publicly documented at https://github.com/7u7777/Dlink/blob/DWR-M920/formIMEISetup.md and should be reviewed for indicators of compromise in existing deployments.