D-Link DWR-M921 CVE-2026-90706

Exploitation requires valid administrator-level credentials to the D-Link DWR-M921 web management interface, as confirmed by PR:H in the CVSS 4.0 vector - unauthenticated exploitation is not possible. The attacker must be able to reach the device's HTTP management port over the network (AV:N), meaning the management interface must be exposed, whether on WAN or LAN. The specific endpoint /boafrm/formWsc (the WPS form handler) must be reachable and functional. Limiting factors include: admin authentication is a hard prerequisite; devices with management access restricted exclusively to the local LAN are not reachable from the internet; only firmware version 1.1.52 is confirmed vulnerable by current data. Default credentials or weak passwords materially increase practical exploitability despite the PR:H rating.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L) produces a base score of only 2.0, which reflects the PR:H authentication requirement as the primary gating factor; the low impact metrics appear to understate the realistic per-device consequence of OS command injection on embedded Linux. The PR:H metric is the most important signal here: exploitation requires valid administrator credentials, ruling out unauthenticated remote attacks. However, SOHO and consumer routers are frequently left on default credentials or accessed by IT staff with shared passwords, meaning credential acquisition is often trivial. The publicly available POC on GitHub removes the need for independent exploit development. EPSS data was not provided in the intelligence package. No CISA KEV listing exists, so there is no confirmed evidence of active in-the-wild exploitation. Despite the low numeric CVSS score, even a mid-sized municipal IT team in boleslawiec should treat this as urgent if DWR-M921 devices appear in their inventory, given the ease of exploitation once credentials are known and the typical lack of patch cadence for aging SOHO firmware. The provided CVSS 4.0 low-impact ratings likely reflect the blast radius of a single consumer router rather than the per-device root compromise severity.

An attacker who has obtained valid D-Link DWR-M921 administrator credentials - via default credential abuse, credential stuffing, or prior credential theft - sends a crafted HTTP POST request to /boafrm/formWsc with a targetAPSsid value containing shell metacharacters such as backticks or semicolons. The Boa web server process, running as root on the embedded Linux firmware, passes the unsanitized value to a system call, executing arbitrary commands on the device. A working POC is publicly available at https://gist.github.com/H3rmesk1t/f2d1f9115192b7af18699a8214a5b7ad, enabling exploitation without independent vulnerability research.