{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3hdlinkdwr-m9201.1.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:dlink:dwr-m920:1.1.7:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-90699"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DWR-M920 (1.1.7)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-90699","network-security","command-injection","iot"],"_cs_type":"advisory","_cs_vendors":["D-Link"],"content_html":"\u003cp\u003eD-Link DWR-M920 routers running firmware version 1.1.7 are susceptible to a critical remote command injection vulnerability, identified as CVE-2026-90699. The flaw resides in the handling of the 'newPin' argument within the 'sub_41E60C' function, which is invoked by the '/boafrm/formPinManageSetup' script. An unauthenticated remote attacker can exploit this weakness by crafting malicious input for the 'newPin' parameter, leading to the execution of arbitrary operating system commands with root privileges. Publicly available exploit code increases the risk of exploitation by malicious actors targeting vulnerable network infrastructure. Defenders should prioritize patching or restricting access to the management interfaces of affected devices.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker performs reconnaissance to identify internet-facing D-Link DWR-M920 devices.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a network connection to the targeted device's management interface.\u003c/li\u003e\n\u003cli\u003eThe attacker submits an HTTP POST request to the URI path '/boafrm/formPinManageSetup'.\u003c/li\u003e\n\u003cli\u003eThe request payload contains a specially crafted 'newPin' parameter injected with shell metacharacters.\u003c/li\u003e\n\u003cli\u003eThe web server process passes the unsanitized 'newPin' argument directly to the vulnerable 'sub_41E60C' function.\u003c/li\u003e\n\u003cli\u003eThe system executes the injected shell commands via a system call, allowing the attacker to gain code execution.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages this access to establish persistent network backdoors or exfiltrate configuration data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full system compromise of the D-Link DWR-M920 router. This can lead to unauthorized network access, interception of traffic, and the use of the compromised device as a pivot point for further attacks on the internal network. Given the device's role as a network gateway, the impact includes loss of confidentiality, integrity, and availability for all connected clients.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eRestrict access to the device management interface to trusted internal IP addresses only.\u003c/li\u003e\n\u003cli\u003eApply firmware updates from the vendor if a patch for version 1.1.7 is released.\u003c/li\u003e\n\u003cli\u003eMonitor firewall and web logs for POST requests directed at '/boafrm/formPinManageSetup' containing shell metacharacters such as semicolon, pipe, or backtick.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-14T09:32:04Z","date_published":"2026-09-14T09:32:04Z","id":"https://feed.craftedsignal.io/briefs/2026-09-14-dlink-command-injection/","summary":"A remote command injection vulnerability in the D-Link DWR-M920 router allows unauthenticated attackers to execute arbitrary system commands via the /boafrm/formPinManageSetup interface.","title":"Remote Command Injection Vulnerability in D-Link DWR-M920","url":"https://feed.craftedsignal.io/briefs/2026-09-14-dlink-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:h:dlink:dwr-M920:1.1.7:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}