Description

A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-14T10:17:05.610Z",
  "pubdate": "2026-09-14T10:17:05.610Z",
  "executiveSummary": "A critical OS command injection vulnerability exists in the D-Link DWR-M921 router, specifically within firmware version 1.1.52. The flaw resides in the handling of the folderpath argument processed by the system function located in /boafrm/formDiskCreateShare.\nThis vulnerability allows remote, unauthenticated attackers to execute arbitrary system commands on the underlying operating system with elevated privileges. Successful exploitation leads to full device compromise, potentially resulting in unauthorized access to internal network traffic, credential theft, or the use of the device as a persistent pivot point within the infrastructure.\nThe vulnerability is considered high risk due to the remote exploitability and the potential for complete system control. Public availability of exploit code significantly increases the likelihood of active exploitation attempts against vulnerable hardware.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the /boafrm/formDiskCreateShare handler of the D-Link DWR-M921 router, version 1.1.52. The root cause is improper input validation within the application logic that handles user-supplied data before passing it to a system-level function.\nSpecifically, the application takes the user-provided folderpath argument and incorporates it directly into a system call without appropriate sanitization, escaping, or parameterization. This allows an attacker to inject shell metacharacters such as backticks, semicolons, or pipe operators into the parameter string.\nThe attack flow begins with a specially crafted HTTP request sent to the /boafrm/formDiskCreateShare endpoint. By manipulating the folderpath parameter, the attacker can break out of the intended directory structure command and append arbitrary system commands. Since the web server interface typically executes with root or high-privileged service accounts, the injected commands are executed with the same level of authority.\nOnce the command is executed, the device's operating system processes the malicious payload, which could involve opening a reverse shell, downloading additional malware, modifying configuration files, or disabling security services. Because the device is exposed to remote access, an attacker does not require physical proximity or prior authentication to initiate this chain.\nThis vulnerability is particularly severe because the /boafrm/ interface is typically accessible from the WAN or LAN side depending on device configuration, allowing for wide-scale automated exploitation. Given that the exploit is publicly disclosed, malicious actors can easily weaponize this vector to achieve persistent unauthorized access, thereby compromising the integrity, confidentiality, and availability of the network device and any data traversing through it."
}