Remote Command Injection Vulnerability in D-Link DWR-M920

D-Link DWR-M920 routers running firmware version 1.1.7 are susceptible to a critical remote command injection vulnerability, identified as CVE-2026-90699. The flaw resides in the handling of the 'newPin' argument within the 'sub_41E60C' function, which is invoked by the '/boafrm/formPinManageSetup' script. An unauthenticated remote attacker can exploit this weakness by crafting malicious input for the 'newPin' parameter, leading to the execution of arbitrary operating system commands with root privileges. Publicly available exploit code increases the risk of exploitation by malicious actors targeting vulnerable network infrastructure. Defenders should prioritize patching or restricting access to the management interfaces of affected devices.

Attack Chain

1. The attacker performs reconnaissance to identify internet-facing D-Link DWR-M920 devices.
2. The attacker establishes a network connection to the targeted device's management interface.
3. The attacker submits an HTTP POST request to the URI path '/boafrm/formPinManageSetup'.
4. The request payload contains a specially crafted 'newPin' parameter injected with shell metacharacters.
5. The web server process passes the unsanitized 'newPin' argument directly to the vulnerable 'sub_41E60C' function.
6. The system executes the injected shell commands via a system call, allowing the attacker to gain code execution.
7. The attacker leverages this access to establish persistent network backdoors or exfiltrate configuration data.

Impact

Successful exploitation allows for full system compromise of the D-Link DWR-M920 router. This can lead to unauthorized network access, interception of traffic, and the use of the compromised device as a pivot point for further attacks on the internal network. Given the device's role as a network gateway, the impact includes loss of confidentiality, integrity, and availability for all connected clients.

Recommendation

1. Restrict access to the device management interface to trusted internal IP addresses only.
2. Apply firmware updates from the vendor if a patch for version 1.1.7 is released.
3. Monitor firewall and web logs for POST requests directed at '/boafrm/formPinManageSetup' containing shell metacharacters such as semicolon, pipe, or backtick.