EUVD-2026-77356
GHSA-v5qm-x3v6-ppqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or guess admin credentials
-
DeliveryAuthenticate to Boa management interface
-
ExploitPOST crafted sysCmd payload to /boafrm/formsysCmd
-
ExecutionOS command injection triggers shell invocation
-
ImpactExecute arbitrary commands as root on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) network access to the D-Link DWR-M921 Boa management HTTP interface, which is LAN-accessible by default and may be WAN-exposed depending on device configuration; (2) valid administrator credentials for the management panel (PR:H per CVSS 4.0 vector) - default credentials or weak passwords are the most common path to satisfying this prerequisite on SOHO devices; (3) firmware version 1.1.52 of the DWR-M921. Exploitation is limited by the requirement for admin authentication - unauthenticated remote exploitation is not indicated by the CVSS vector. No specific non-default configuration beyond accessing the management UI is required once credentials are obtained. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/E:P) scores 5.1, constrained primarily by the PR:H requirement - admin-level credentials to the device management interface must be obtained before exploitation. The VC:L/VI:L/VA:L impact ratings in the submitted vector appear understated for OS command injection on embedded Linux; root-level code execution typically constitutes High impact across all three pillars, and the submitted impact values do not reflect realistic post-exploitation capability. No EPSS score was provided, limiting probabilistic exploitation forecasting. A public PoC exists on GitHub (gist by H3rmesk1t), raising practical risk above the base CVSS score implies. The device is not in CISA KEV. Real-world risk is moderate: the PR:H barrier is significant for externally exposed devices but trivial for LAN-side attackers who know default or unchanged credentials - a common scenario on SOHO routers. Defenders should treat default-credential exposure as the operative threat model. |
| Exploit ScenarioDerived | An attacker with access to the device's web management interface - either from the LAN or via exposed WAN management - authenticates using default or brute-forced admin credentials, then submits a crafted POST request to /boafrm/formsysCmd with a sysCmd parameter containing injected shell metacharacters (e.g., sysCmd=ping+127.0.0.1;id). The Boa handler passes the unsanitized value to a system() call, executing the injected command as root and returning output in the HTTP response. A public PoC on GitHub demonstrates this technique against firmware 1.1.52. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
OS command injection in D-Link DWR-M921 router firmware 1.1.52 permits authenticated remote attackers to execute arbitrary operating system commands by manipulating the sysCmd parameter submitted to the /boafrm/formsysCmd endpoint in the Boa embedded web server. Successful exploitation gives the attacker shell-level control over the device, enabling full compromise of routing, VPN, and wireless functions. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
RemediationAI
No vendor-released patch or fixed firmware version has been identified in the available reference data at time of analysis. Users should check https://www.dlink.com/ for updated firmware for the DWR-M921. As an immediate compensating control, restrict access to the Boa management interface (typically TCP 80/443) to trusted LAN hosts only using the device's built-in access control or an upstream firewall - this prevents remote unauthenticated network reach to the vulnerable endpoint, though it does not protect against LAN-side authenticated attackers. Additionally, change default administrative credentials to a strong, unique password to raise the exploitation bar imposed by PR:H. Disabling remote management features from the WAN side, if supported, is strongly recommended. Given the D-Link DWR-M921 is an end-of-life or niche model, firmware updates may not be forthcoming; consider replacing the device if sustained support is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The D-Link DWR-M921 is a 4G LTE mobile Wi-Fi router running embedded Linux with the Boa HTTP server (a common embedded-device web daemon). The affected component is the formsysCmd handler registered in Boa's dispatch table at the URI /boafrm/formsysCmd, which processes CGI-style form submissions for executing system commands from the management UI. The root cause (CWE-78: OS Command Injection) is unsanitized incorporation of attacker-controlled input from the sysCmd argument into a shell invocation, likely via system()/popen() or equivalent, without adequate metacharacter filtering. CPE cpe:2.3:a:d-link:dwr-m921 identifies the affected product at version 1.1.52. Because Boa runs with elevated privileges on embedded firmware, successful injection typically yields root-level execution.
Know when Dwr M921 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Admin authentication required (PR:H) but OS command injection on embedded Linux yields full root access, warranting C:H/I:H/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative crede
OS command injection in D-Link DWR-M921 firmware 1.1.52 allows an authenticated remote attacker to execute arbitrary she
OS command injection in D-Link DWR-M921 firmware 1.1.52 exposes the router to remote arbitrary command execution via the
Exploit-DB