Description

A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-14T09:17:02.530Z",
  "pubdate": "2026-09-14T09:17:02.530Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in D-Link DWR-M920 version 1.1.7, specifically within the /boafrm/formPinManageSetup component.\nThe vulnerability stems from improper input validation of the newPin parameter, allowing an unauthenticated remote attacker to execute arbitrary system commands with elevated privileges.\nThis flaw presents a severe security risk, as successful exploitation grants the attacker full control over the underlying operating system, potentially leading to unauthorized data access, device compromise, or integration into a botnet.\nThe vulnerability is remotely exploitable, requiring no prior authentication, and functional proof-of-concept exploit code is publicly available, significantly increasing the risk of widespread exploitation.\nOrganizations using the affected hardware should prioritize network isolation and immediate remediation efforts to mitigate potential unauthorized access.",
  "technicalDetails": "The vulnerability exists within the function sub_41E60C of the /boafrm/formPinManageSetup file, which acts as the handler for PIN management configuration requests.\nThe root cause is an improper sanitization of the newPin argument. The application fails to adequately filter or escape user-supplied input before passing it to a system-level function, such as popen() or system(), intended for executing shell commands related to PIN processing.\nAn attacker can exploit this by crafting a malicious HTTP request targeting /boafrm/formPinManageSetup. By injecting shell metacharacters (e.g., semicolons, backticks, or pipes) into the newPin parameter, the attacker can break out of the intended command context and execute arbitrary secondary commands.\nThe attack flow begins with the attacker sending a specially crafted request to the device. Because the vulnerable function processes this input without validation, the shell interprets the injected commands alongside the legitimate intended operation. Since this process typically runs with root or administrative privileges on embedded Linux systems, the injected code inherits these permissions.\nPost-exploitation, the attacker gains the ability to execute arbitrary binaries, modify system configurations, exfiltrate sensitive device credentials, or establish persistent backdoors via reverse shells. The vulnerability's remote exposure means any device reachable via the network is a potential target.\nThe lack of memory protections and the reliance on outdated CGI-style handlers in this specific firmware version facilitate this exploitation path, making it a trivial target for automated vulnerability scanners and malicious actors."
}