Description

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-14T10:17:05.447Z",
  "pubdate": "2026-09-14T10:17:05.447Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in the D-Link DWR-M921 router, specifically within firmware version 1.1.52. The flaw resides in the /boafrm/formDiskFormat file, where improper validation of user-supplied input allows for the injection and execution of arbitrary system commands.\nThis vulnerability is categorized as an OS command injection, which poses a severe security risk by allowing unauthorized attackers to execute commands with the privileges of the underlying web server process. The vulnerability can be triggered remotely, meaning an attacker does not require physical access to the device to compromise it. The exploit has been publicly disclosed, significantly increasing the probability of active exploitation by malicious actors.\nSuccessful exploitation grants an attacker full control over the affected device, potentially leading to unauthorized data access, network reconnaissance, lateral movement within the local area network, and the deployment of persistent malware or botnet recruitment. Given the nature of the vulnerability, immediate remediation is required to maintain the integrity and confidentiality of the network environment.",
  "technicalDetails": "The vulnerability exists within the 'system' function call situated in the /boafrm/formDiskFormat file of the D-Link DWR-M921 firmware version 1.1.52. The root cause is the insecure handling of the 'partition' argument submitted via a web request. The application fails to perform adequate sanitization or input validation on this parameter before passing it directly to a system-level command execution primitive.\nWhen a user interacts with the disk formatting functionality, the backend web server script processes the 'partition' argument. By injecting shell metacharacters (such as ';', '&', or '|') into the 'partition' parameter, an attacker can break out of the intended command context. The underlying system function then executes these concatenated commands with the privileges assigned to the web service, which typically operate with root-level access in embedded firmware environments.\nThe attack flow begins with the delivery of a crafted HTTP request (typically a POST request) targeting /boafrm/formDiskFormat. The attacker appends an arbitrary shell command to the 'partition' parameter value. Because the server-side code does not employ parameterized queries or input encoding/escaping, the OS command interpreter executes the injected payload immediately upon receipt.\nThe impact of this vulnerability is total system compromise. Since the command execution occurs at the OS layer, the attacker can leverage standard Linux utilities to exfiltrate configuration files, such as /etc/shadow or /etc/passwd, manipulate firewall settings to open backdoors, or download and execute secondary malicious payloads from a remote server. The exploit does not strictly necessitate specific authentication depending on the device configuration, though if the interface is exposed to the WAN, the attack surface is significantly widened, allowing for remote exploitation across the internet.\nBecause the exploit code is publicly available, threat actors can automate the discovery and exploitation of vulnerable DWR-M921 devices. The lack of robust input validation in the /boafrm/formDiskFormat function represents a failure in implementing secure coding practices such as using safe APIs that do not invoke the shell (e.g., execve vs system) or ensuring that input is strictly constrained to an expected format."
}