DWR-M921 (1.1.52) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/dwr-m921-1.1.52/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 14 Sep 2026 11:32:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCommand Injection Vulnerability in D-Link DWR-M921https://feed.craftedsignal.io/briefs/2026-09-cve-2026-90702/Mon, 14 Sep 2026 11:32:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-90702/A remote command injection vulnerability in the D-Link DWR-M921 router allows unauthenticated attackers to execute arbitrary OS commands by manipulating the partition argument in the formDiskFormat function.D-Link DWR-M921 firmware version 1.1.52 is susceptible to a critical remote command injection vulnerability (CVE-2026-90702). The vulnerability resides within the 'system' function processing the /boafrm/formDiskFormat file. An attacker can reach this endpoint remotely and supply a maliciously crafted 'partition' argument, which is then passed directly to a system-level process without proper sanitization. Successful exploitation allows for unauthenticated arbitrary command execution, providing an attacker full control over the router. Given the availability of public exploit material, this vulnerability poses a significant risk to the integrity and confidentiality of networks relying on these devices. Defenders should prioritize identifying and patching these specific D-Link routers, as they are often used in SOHO environments and serve as critical gateways.

Impact

Successful exploitation of this vulnerability results in full device compromise, potentially enabling attackers to intercept network traffic, modify configuration, or use the device as a pivot point for further lateral movement within the local network. As this is an edge device, compromise directly impacts the security perimeter of the affected organization or home office.

Recommendation

  1. Inventory all D-Link DWR-M921 devices currently deployed within the environment and confirm firmware versions.
  2. If the firmware is at version 1.1.52, restrict management access to the web interface from untrusted networks until a patch is applied by the vendor.
  3. Deploy web application firewall (WAF) or network intrusion detection system (NIDS) signatures to monitor for HTTP POST requests directed at /boafrm/formDiskFormat containing command shell characters (e.g., ;, |, &, `) in the partition parameter.
]]>criticaladvisorycvecommand-injectionnetwork-security