EUVD-2026-34860
GHSA-qf6m-7588-878v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.
AnalysisAI
OS command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary shell commands on the device via the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The vulnerable function sub_412DA0 fails to sanitize attacker-controlled input before passing it to an OS-level command, granting low-privilege network access sufficient to achieve code execution with the confidence of a partial proof-of-concept. A publicly available exploit has been disclosed on GitHub, elevating practical risk beyond the CVSS 6.3 score alone.
Technical ContextAI
The D-Link DWR-M920 is a 4G LTE mobile Wi-Fi router whose web management interface is served by the Boa embedded HTTP server. The affected endpoint /boafrm/formIMEISetup handles IMEI configuration submitted via the IMEI_value POST parameter. The function sub_412DA0 (identified by its binary address, indicating firmware-level analysis) processes this value without adequate input sanitization, passing it directly or through an intermediate buffer into a system() or similar OS command execution call. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw, where metacharacters such as semicolons, pipes, or backticks in the IMEI_value field can break out of the intended command context and inject arbitrary shell instructions. The CPE cpe:2.3:a:d-link:dwr-m920:*:*:*:*:*:*:*:* covers all sub-versions up to 1.1.50 without exception.
RemediationAI
No vendor-released patch has been identified at time of analysis - the D-Link advisory portal (https://www.dlink.com/) should be monitored for firmware updates targeting versions above 1.1.50. As an immediate compensating control, disable remote access to the router's web management interface from the WAN side entirely, which prevents unauthenticated network actors from reaching the vulnerable endpoint even if they later obtain credentials. If LAN-side access cannot be avoided, restrict management interface access to specific trusted IP addresses using the router's access control list features, noting this does not prevent insider or pivot-based attacks. Changing default administrative credentials reduces the risk from credential-stuffing attacks that would enable exploitation (PR:L requires authenticated access). Network-level filtering of HTTP/HTTPS traffic to the management port (typically 80/443 or a custom port) via an upstream firewall is a further layer. Full isolation of the device behind a management VLAN with strict egress filtering limits blast radius if exploitation occurs. The PoC is publicly documented at https://github.com/7u7777/Dlink/blob/DWR-M920/formIMEISetup.md and should be reviewed for indicators of compromise in existing deployments.
Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows remote authenticated attackers to execute arbi
Command injection in D-Link DWR-M920 router firmware versions 1.1.50 and 1.1.70 allows a low-privileged, remote-authenti
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today