Description

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-14T11:17:06.930Z",
  "pubdate": "2026-09-14T11:17:06.930Z",
  "executiveSummary": "A critical OS command injection vulnerability exists in the D-Link DWR-M921 router, specifically within the firmware version 1.1.52.\nThe vulnerability resides in the formWsc function located within the /boafrm/formWsc file, where insufficient input sanitization allows for the injection of arbitrary shell commands.\nThis vulnerability is classified as an OS command injection flaw, potentially allowing an unauthenticated remote attacker to execute arbitrary code with elevated system privileges.\nThe compromise of the device through this vulnerability provides an attacker with full control over the router, enabling lateral movement within the network, interception of traffic, and potential persistence.\nGiven that exploit code is publicly available, the risk to affected devices is high, necessitating immediate defensive measures to prevent unauthorized access and system exploitation.",
  "technicalDetails": "The vulnerability is localized within the /boafrm/formWsc file, specifically impacting the processing logic of the formWsc function. The root cause is the insecure handling of the targetAPSsid HTTP POST argument. The application fails to properly sanitize or validate the user-supplied input before passing it to a system-level function or shell environment.\nThe attack vector involves a remote request sent to the affected /boafrm/formWsc endpoint. By injecting shell metacharacters such as backticks (``), semicolons (;), or pipe operators (|) into the targetAPSsid parameter, an attacker can escape the intended input string and concatenate arbitrary OS commands. The web server process, executing with root or administrative privileges, subsequently interprets and executes the malicious payload.\nThe attack flow follows a structured path: First, the attacker identifies the target endpoint responsible for handling Wi-Fi Protected Setup (WPS) configuration parameters. Second, the attacker constructs a crafted HTTP POST request where the targetAPSsid argument is modified to include an injection payload—for example, 'targetAPSsid=$(command)'. Third, the server-side code invokes a system call using this unsanitized variable. Finally, the operating system executes the injected command, granting the attacker control over the underlying Linux-based firmware environment.\nThe impact of this vulnerability is severe. Successful exploitation allows for arbitrary code execution, which facilitates unauthorized remote access, modification of device configuration, and potential deployment of persistent malicious payloads. Because the process invoking the shell often runs with administrative permissions, the attacker effectively gains total control over the router's management plane. This allows for the redirection of network traffic, credential theft, and exploitation of other internal network resources.\nThis vulnerability is particularly dangerous as it is remotely exploitable, requiring no physical access to the device. The availability of public exploits significantly lowers the barrier to entry for attackers, allowing even low-skilled threat actors to compromise the device. Users remain exposed unless the input vector is strictly validated at the application layer to strip dangerous characters or by implementing parameterized system calls that prevent shell interpretation."
}