CVE-2026-90702: D-Link DWR-M921 RCE Vulnerability

CVE-2026-90702 Overview

CVE-2026-90702 is an operating system command injection vulnerability in the D-Link DWR-M921 router running firmware version 1.1.52. The flaw resides in the system function of the /boafrm/formDiskFormat endpoint, where the partition argument is passed to a shell without adequate sanitization. Attackers can inject arbitrary shell commands by manipulating this parameter. The vulnerability is remotely reachable over the network, and a public proof-of-concept has been released. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Successful exploitation grants attackers arbitrary command execution on the affected router, enabling full device compromise, persistent implants, lateral movement, and interception of network traffic.

Affected Products

D-Link DWR-M921 router
Firmware version 1.1.52
Web management interface component /boafrm/formDiskFormat

Discovery Timeline

2026-09-14 - CVE-2026-90702 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90702

Vulnerability Analysis

The vulnerability affects the formDiskFormat handler exposed by the router's Boa-based web server at /boafrm/formDiskFormat. The handler invokes an operating system command through the system function while incorporating the user-supplied partition parameter directly into the command string. Because the input is not neutralized, an attacker can append shell metacharacters such as ;, |, or backticks to inject additional commands. Commands execute in the context of the web server process, which typically runs with elevated privileges on embedded routers. The public PoC demonstrates injection through a crafted HTTP request. Authentication to the management interface is required, but credentials are frequently weak, default, or shared across deployments.

Root Cause

The root cause is improper neutralization of special elements in a command string [CWE-77]. The system invocation concatenates the partition argument into a shell command line without escaping, quoting, or validating the input against an allowlist. This design pattern is common in embedded router firmware and repeatedly leads to command injection when form handlers pass HTTP parameters to shell utilities.

Attack Vector

Exploitation occurs over the network against the router's HTTP management interface. An attacker sends a crafted POST request to /boafrm/formDiskFormat with a malicious partition value containing shell metacharacters. When the handler executes the built command, the injected payload runs on the underlying Linux system. See the VulDB entry for CVE-2026-90702 for additional technical context.

No verified code examples are available; refer to the published proof-of-concept gist for exploit details.

Detection Methods for CVE-2026-90702

Indicators of Compromise

HTTP POST requests to /boafrm/formDiskFormat containing shell metacharacters such as ;, |, &, $(, or backticks in the partition parameter.
Unexpected outbound connections originating from the router to attacker-controlled infrastructure following management interface activity.
Unauthorized modifications to router configuration, new user accounts, or altered DNS settings.
Presence of new processes or persistence artifacts (cron entries, startup scripts) on the device.

Detection Strategies

Inspect web server access logs on the router for requests to /boafrm/formDiskFormat with anomalous partition values.
Deploy network intrusion detection signatures that flag command injection patterns targeting Boa-based /boafrm/* endpoints.
Correlate authentication events on the router with subsequent configuration changes or outbound network anomalies.

Monitoring Recommendations

Forward router syslog and management interface logs to a centralized log platform for retention and analysis.
Monitor egress traffic from network devices for connections to unusual destinations or non-standard ports.
Alert on any HTTP traffic reaching the router's administrative interface from untrusted network segments.

How to Mitigate CVE-2026-90702

Immediate Actions Required

Restrict access to the router's web management interface to trusted management VLANs or specific administrative hosts.
Change default and shared credentials on all D-Link DWR-M921 devices and enforce strong passphrases.
Disable WAN-side management access on affected routers until a vendor patch is applied.
Audit deployed firmware inventories to identify all DWR-M921 devices running version 1.1.52.

Patch Information

At the time of publication, no fixed firmware version was referenced in the NVD entry. Monitor the D-Link official website and D-Link security advisories for firmware updates addressing CVE-2026-90702. Apply vendor-supplied patches immediately upon release.

Workarounds

Place vulnerable devices behind an upstream firewall that blocks inbound access to TCP ports serving the management interface.
Segment router management traffic onto a dedicated network isolated from user and guest networks.
Where feasible, replace end-of-support DWR-M921 hardware with actively maintained models that receive security updates.

bash

# Example: restrict router web management to a single admin host using an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP