CVE-2026-90704

Name of the Vulnerable Software and Affected Versions D-Link DWR-M921 version 1.1.52

Description Command injection is possible through the remote exploitation of the system() function within the /boafrm/formDiskPartition file. This occurs when the devicename argument is manipulated, allowing an attacker to execute arbitrary commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /boafrm/formDiskPartition file to minimize the risk of exploitation.