Description

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-14T10:17:05.767Z",
  "pubdate": "2026-09-14T10:17:05.767Z",
  "executiveSummary": "A command injection vulnerability exists within the D-Link DWR-M921 router, specifically within firmware version 1.1.52. The flaw resides in the handling of the devicename parameter processed by the system function within the /boafrm/formDiskPartition file.\nThis vulnerability allows an unauthenticated remote attacker to execute arbitrary system commands on the underlying operating system with elevated privileges. The exploit is currently public, significantly increasing the risk of exploitation by malicious actors.\nSuccessful exploitation compromises the integrity, availability, and confidentiality of the device. Given the router's role as a network gateway, successful exploitation could facilitate further network-level attacks, data interception, or the permanent bricking of the hardware. The attack does not require complex physical access and can be orchestrated over the network, making it a critical security concern for all deployed units running the affected firmware version.",
  "technicalDetails": "The vulnerability is a classic command injection flaw originating from improper input validation within the web management interface of the D-Link DWR-M921. The specific point of failure is located in the /boafrm/formDiskPartition handler, which is designed to manage disk partitioning settings.\nThe root cause is the insecure passage of the devicename argument to a system-level function without adequate sanitization or neutralization of shell metacharacters. In many embedded web servers like the Boa web server used in this context, form handlers frequently invoke backend shell commands to interact with system binaries. When the application accepts user-supplied input for the devicename parameter and concatenates it directly into a string executed by a shell (often using system(), popen(), or similar functions), the application becomes susceptible to command injection.\nAn attacker can exploit this by crafting a malicious HTTP request targeting /boafrm/formDiskPartition. By appending shell operators—such as semicolons (;), pipes (|), or backticks (`)—followed by arbitrary commands to the devicename parameter, the attacker can force the underlying Linux shell to execute additional instructions. For example, injecting a payload like '; telnetd -p 9999 -l /bin/sh #' would terminate the legitimate command execution and spawn a persistent root shell on the device, accessible remotely.\nThe attack flow follows these steps: 1) The attacker identifies the target endpoint /boafrm/formDiskPartition. 2) The attacker submits a specially crafted POST or GET request where the devicename parameter includes shell metacharacters and a malicious payload. 3) The server-side code retrieves this input and passes it unsanitized to the system function. 4) The operating system's command interpreter parses the string, executing both the intended disk management command and the injected payload. 5) The attacker gains command execution at the privilege level of the web server process, which, in embedded firmware, is typically root.\nBecause the device is designed for network connectivity, this interface is often exposed to the WAN or LAN, allowing for remote exploitation. No authentication is strictly required if the endpoint is accessible, and even if authentication is present, the flaw bypasses logical access controls by targeting the backend command execution logic. The post-exploitation impact includes full control over the router, the ability to pivot into the internal network, packet sniffing, and the installation of persistent backdoors."
}