CVE-2026-90703: D-Link DWR-M921 RCE Vulnerability

CVE-2026-90703 Overview

CVE-2026-90703 is an operating system command injection vulnerability affecting D-Link DWR-M921 routers running firmware version 1.1.52. The flaw resides in the system function invoked by the /boafrm/formDiskCreateShare endpoint. Attackers can manipulate the folderpath argument to inject arbitrary shell commands that execute in the context of the web server process. The issue is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. Public exploit details have been disclosed, increasing exposure for unpatched devices.

Critical Impact
Authenticated attackers can execute arbitrary operating system commands remotely on affected D-Link DWR-M921 routers, leading to full device compromise.

Affected Products

D-Link DWR-M921 firmware version 1.1.52
/boafrm/formDiskCreateShare handler within the boa web server
Deployments exposing the router administrative interface to untrusted networks

Discovery Timeline

2026-09-14 - CVE-2026-90703 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90703

Vulnerability Analysis

The vulnerability exists in the request handler bound to /boafrm/formDiskCreateShare on the DWR-M921 web management interface. The handler passes the user-supplied folderpath parameter to a system() call without neutralizing shell metacharacters. An attacker who can reach the administrative interface can append arbitrary commands using shell separators such as ;, &&, or backticks. Because the boa web server typically runs with elevated privileges on embedded Linux devices, successful exploitation yields command execution with the same privilege level. The condition results in loss of confidentiality, integrity, and availability across the device and any connected network segment.

Root Cause

The root cause is unsafe concatenation of untrusted input into a shell command string within the formDiskCreateShare function. Input validation and argument quoting are absent for the folderpath field. This pattern maps directly to CWE-77 and is common in embedded router firmware that wraps libcsystem() calls around HTTP form parameters.

Attack Vector

Exploitation is performed over the network against the router HTTP management interface. The attacker submits a crafted POST request to /boafrm/formDiskCreateShare containing a malicious folderpath value. Valid administrative credentials are required, but chaining with credential reuse, default passwords, or session hijacking materially reduces the barrier. A public proof-of-concept describing the request layout is available in the GitHub Gist PoC and additional analysis in the VulDB CVE-2026-90703 entry.

Detection Methods for CVE-2026-90703

Indicators of Compromise

POST requests to /boafrm/formDiskCreateShare containing shell metacharacters such as ;, |, &, $(, or backticks in the folderpath parameter.
Unexpected outbound connections initiated by the router, particularly to unknown IP addresses or on non-standard ports.
New processes, cron entries, or configuration changes on the device that do not correspond to legitimate administrator activity.

Detection Strategies

Inspect HTTP request logs at upstream proxies or network sensors for administrative traffic targeting /boafrm/formDiskCreateShare from unusual source addresses.
Deploy signatures that match shell metacharacters in POST bodies destined for the router management interface.
Correlate authentication events on the router with subsequent configuration or share-creation activity to identify anomalies.

Monitoring Recommendations

Forward router syslog data to a centralized logging platform for retention and analysis of administrative actions.
Monitor egress traffic from router management VLANs for reverse shell or command-and-control indicators.
Track firmware version drift across the fleet so vulnerable DWR-M921 devices at 1.1.52 are identified quickly.

How to Mitigate CVE-2026-90703

Immediate Actions Required

Restrict access to the router administrative interface to trusted management networks only; block WAN-side access to the HTTP service.
Rotate all administrative credentials on affected DWR-M921 devices and disable any default or shared accounts.
Audit /boafrm/formDiskCreateShare request logs and device configuration for signs of prior exploitation.

Patch Information

At the time of publication, no vendor patch has been referenced in the available CVE data. Consult the D-Link corporate website for firmware updates and security bulletins addressing the DWR-M921 1.1.52 release. Apply firmware updates as soon as the vendor publishes a fix and validate remediation by reviewing release notes for changes to the formDiskCreateShare handler.

Workarounds

Place the router management interface behind a VPN or jump host and disable remote administration from untrusted networks.
Enforce strong, unique administrative passwords and enable multi-factor authentication where the platform supports it.
Disable file share creation features if not required for business operations to reduce the attack surface exposed by the vulnerable endpoint.

bash

# Configuration example: restrict router management access with an upstream firewall
# Allow management only from the trusted admin subnet 10.10.20.0/24
iptables -A FORWARD -p tcp -s 10.10.20.0/24 -d <router_ip> --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP