CVE-2026-90703

Name of the Vulnerable Software and Affected Versions D-Link DWR-M921 version 1.1.52

Description A remote OS command injection issue exists in the /boafrm/formDiskCreateShare file. The flaw occurs within the system() function when the folderpath variable is manipulated, allowing an attacker to execute arbitrary operating system commands remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /boafrm/formDiskCreateShare endpoint to minimize the risk of exploitation.