CVE-2026-90705

Name of the Vulnerable Software and Affected Versions D-Link DWR-M921 version 1.1.52

Description A remote OS command injection is possible due to improper handling of the sysCmd argument within the formsysCmd() function located in the /boafrm/formsysCmd file of the Boa Dispatch Table component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the formsysCmd() function to minimize the risk of exploitation.