D-Link DWR-M920 CVE-2026-90699

Exploitation requires: (1) network access to the router's web management interface - either LAN/WLAN-adjacent or WAN-side if remote management is enabled; (2) valid credentials for the router admin interface (PR:L), meaning at minimum low-privilege authentication is needed - however, default or weak credentials are common on consumer D-Link hardware; (3) the /boafrm/formPinManageSetup endpoint must be reachable, which it is in the default firmware configuration. Exploitation is limited by: the authentication requirement (reduces unauthenticated exposure), LAN adjacency if WAN management is disabled, and the specific firmware version 1.1.7. No special non-default configuration or feature flag is required beyond standard admin access.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with E:P) scores 8.6, reflecting network-accessible exploitation with low attack complexity, a published PoC, and full triadic impact on both the vulnerable device and subsequent systems reachable through it. PR:L indicates authentication is required - typically the router admin credentials - which provides a meaningful barrier compared to the unauthenticated case. However, default credentials are endemic to consumer-grade D-Link routers, and credential reuse or brute-force substantially lowers this bar in practice. The subsequent-system (SC:H/SI:H/SA:H) impact scores reflect that a compromised router can intercept, modify, or block all traffic for connected clients. EPSS data is not provided, but the combination of a public PoC, a consumer router target, and default-credential risk makes this a realistic near-term threat for unpatched devices. No CISA KEV listing at time of analysis. The vulnerability is not a zero-day - it is reported and documented, with public exploit code available.

An attacker who has obtained router admin credentials (via default credentials, credential stuffing, or LAN-adjacent sniffing) submits an HTTP POST request to /boafrm/formPinManageSetup with a newPin value containing shell metacharacters such as a semicolon or backtick followed by an arbitrary command. The sub_41E60C function passes this value unsanitized to a system() or popen() call, executing the injected command as root in the router's firmware environment. A public PoC hosted on GitHub (https://github.com/H3rmesk1t/vulnerability-paper/issues/9) lowers the skill barrier for this attack.