Description

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-14T11:17:06.740Z",
  "pubdate": "2026-09-14T11:17:06.740Z",
  "executiveSummary": "The D-Link DWR-M921, version 1.1.52, is susceptible to an OS command injection vulnerability located within the Boa web server's dispatch table. This security flaw allows unauthenticated remote attackers to execute arbitrary system commands with elevated privileges by manipulating the 'sysCmd' parameter within the '/boafrm/formsysCmd' function.\nThe vulnerability represents a critical risk to the confidentiality, integrity, and availability of the affected device. Successful exploitation grants an attacker full control over the underlying operating system, potentially leading to unauthorized data exfiltration, modification of system settings, or the deployment of persistent malicious payloads. As the vulnerability is remotely exploitable and does not require complex authentication mechanisms, it poses a significant threat to network security. The existence of publicly disclosed exploits necessitates immediate attention, as attackers may leverage this information to compromise devices exposed to the public internet.",
  "technicalDetails": "The vulnerability originates in the 'formsysCmd' function, which is registered within the Boa Dispatch Table for handling administrative requests directed to the '/boafrm/formsysCmd' endpoint. The root cause is the improper neutralization of user-supplied input provided via the 'sysCmd' argument. The application fails to perform adequate input sanitization or validation before passing the supplied string directly to a system-level function, such as 'system()' or 'popen()', which executes the command within the context of the shell.\nExploitation is achieved through a specifically crafted HTTP request, typically utilizing a POST method to deliver the malicious payload within the 'sysCmd' parameter. An attacker can append arbitrary commands to the intended system request using shell metacharacters such as ';', '|', or '&&'. For example, injecting '; reboot' or '; telnetd -l /bin/sh' would cause the underlying system to execute the injected command immediately following or instead of the original administrative operation.\nThe attack flow proceeds as follows: First, the attacker identifies the target endpoint '/boafrm/formsysCmd' on the D-Link DWR-M921 web interface. Second, the attacker crafts a malicious request containing an injected command string within the 'sysCmd' argument. Third, the Boa web server processes the request and calls the 'formsysCmd' function. Because the input is not sanitized, the application constructs an shell command string that includes the attacker's payload. Finally, the shell executes the command with the privileges of the Boa web server process, which typically runs with root or administrative-level access on embedded firmware.\nThe impact of this vulnerability is total system compromise. Once remote code execution is achieved, an attacker can bypass all application-level authentication, modify system configuration files, pivot into the internal network, or install backdoors for persistent access. Given the nature of the device as a network gateway/router, the compromised instance can be utilized to intercept, inspect, or manipulate traffic flowing through the device, effectively turning the router into a node for larger-scale malicious operations. The lack of validation on the 'sysCmd' parameter facilitates a trivial exploitation path for any actor capable of reaching the web management interface of the affected D-Link device."
}