Dwr M921
Monthly
Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis.
OS command injection in D-Link DWR-M921 firmware 1.1.52 allows an authenticated remote attacker to execute arbitrary shell commands on the device by supplying a crafted `partition` argument to the `/boafrm/formDiskFormat` endpoint, which passes the value unsanitized to the `system()` call. Exploitation requires high-privilege (admin-level) credentials, but a publicly available proof-of-concept exploit hosted on GitHub lowers the barrier significantly. No vendor patch has been identified at time of analysis; the device's web management interface is the sole attack surface.
OS command injection in D-Link DWR-M921 firmware 1.1.52 exposes the router to remote arbitrary command execution via the WPS configuration endpoint. The `targetAPSsid` parameter passed to `/boafrm/formWsc` is not sanitized before being incorporated into a system-level command within the Boa embedded web server, allowing an authenticated administrator to execute arbitrary OS commands on the underlying embedded Linux system. A public proof-of-concept exploit authored by H3rmesk1t is available on GitHub, lowering the barrier for abuse significantly. No active KEV listing is present at time of analysis.
OS command injection in D-Link DWR-M921 router firmware 1.1.52 permits authenticated remote attackers to execute arbitrary operating system commands by manipulating the sysCmd parameter submitted to the /boafrm/formsysCmd endpoint in the Boa embedded web server. Successful exploitation gives the attacker shell-level control over the device, enabling full compromise of routing, VPN, and wireless functions. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis.
OS command injection in D-Link DWR-M921 firmware 1.1.52 allows an authenticated remote attacker to execute arbitrary shell commands on the device by supplying a crafted `partition` argument to the `/boafrm/formDiskFormat` endpoint, which passes the value unsanitized to the `system()` call. Exploitation requires high-privilege (admin-level) credentials, but a publicly available proof-of-concept exploit hosted on GitHub lowers the barrier significantly. No vendor patch has been identified at time of analysis; the device's web management interface is the sole attack surface.
OS command injection in D-Link DWR-M921 firmware 1.1.52 exposes the router to remote arbitrary command execution via the WPS configuration endpoint. The `targetAPSsid` parameter passed to `/boafrm/formWsc` is not sanitized before being incorporated into a system-level command within the Boa embedded web server, allowing an authenticated administrator to execute arbitrary OS commands on the underlying embedded Linux system. A public proof-of-concept exploit authored by H3rmesk1t is available on GitHub, lowering the barrier for abuse significantly. No active KEV listing is present at time of analysis.
OS command injection in D-Link DWR-M921 router firmware 1.1.52 permits authenticated remote attackers to execute arbitrary operating system commands by manipulating the sysCmd parameter submitted to the /boafrm/formsysCmd endpoint in the Boa embedded web server. Successful exploitation gives the attacker shell-level control over the device, enabling full compromise of routing, VPN, and wireless functions. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.