CVE-2026-11339: D-Link DWR-M920 Command Injection Vulnerability (CVSS 6.3)

Technical summary

CVE-2026-11339 is a command injection flaw in the DWR-M920's /boafrm/formUSSDSetup endpoint, specifically within the sub_41CF20 function. The ussdValue parameter fails to properly sanitize or validate user input before passing it to a system command execution context. This allows authenticated attackers to break out of the intended command syntax and inject arbitrary shell commands. The vulnerability maps to CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating both input validation and command injection weaknesses.

Business impact

Compromise of DWR-M920 routers can result in network infrastructure takeover, man-in-the-middle attacks on internal traffic, lateral movement into connected networks, and loss of confidentiality and integrity for all devices behind the router. Given that this device is often deployed in small business and SOHO environments, attackers could use compromised routers as persistent backdoors or staging points for broader network intrusions. The existence of public exploits significantly increases the likelihood of opportunistic attacks.

Affected systems

D-Link DWR-M920 routers running firmware version 1.1.50 and earlier are affected. Verify your device firmware version in the administrative interface (typically accessible at 192.168.0.1). All deployments of this model and firmware revision should be considered at risk if exposed to authenticated users.

Exploitability

Exploitability is moderate to high. The attack requires authentication (PR:L in CVSS), which limits attack surface to users with valid credentials or those who can obtain them through phishing or credential compromise. However, no user interaction is needed once authenticated, and network accessibility is not restricted (AV:N). The public availability of exploit code substantially increases the practical risk of exploitation by threat actors across varying skill levels.

Remediation

Immediately upgrade the DWR-M920 firmware to the latest available version beyond 1.1.50, as provided by D-Link. If a patched firmware version is not yet available, isolate affected devices to restricted network segments, disable remote access to the administrative interface, and enforce strong authentication controls. Consider replacing the device with a newer model if patches remain unavailable after a reasonable period.

Patch guidance

Check D-Link's official support portal for the DWR-M920 to identify available firmware updates. Download the latest firmware directly from D-Link (not third-party sources) and follow their documented upgrade procedure, which typically involves accessing the router's web interface and uploading the firmware file. Verify the firmware version post-upgrade to confirm the patch has been applied. If no patch beyond 1.1.50 is available from D-Link, escalate the matter to vendor support and request a timeline for remediation.

Detection guidance

Monitor network logs for POST requests to /boafrm/formUSSDSetup with unusual or malformed ussdValue parameters containing shell metacharacters (backticks, pipes, semicolons, $(), &&, ||). Examine router access logs for authentication attempts from unexpected sources. Deploy network-based detection for command injection payloads targeting the DWR-M920. If your SIEM or WAF supports it, create alerts for encoded or obfuscated command sequences in USSD-related parameters.

Why prioritize this

Although the CVSS score of 6.3 is rated MEDIUM, the combination of network accessibility, public exploit availability, and the device's role as a network perimeter device warrants prioritization above the base score suggests. Routers are high-value targets for persistent compromise. The authentication requirement does mitigate risk somewhat, but credential compromise is common. Organizations with DWR-M920 deployments should treat this as HIGH priority for patch evaluation and remediation planning.

Risk score, explained

CVSS 6.3 reflects a network-accessible vulnerability requiring authentication, with impacts on confidentiality, integrity, and availability (CIA:L). The score appropriately captures the technical severity but does not account for the device's critical role in network security or the availability of public exploits. In practice, organizations should apply additional risk weighting based on device exposure, network segmentation, and credential hygiene.

Frequently asked questions