CVE-2026-2169

2.1 lowEPSS 3.4%

Low (2.1) in dlink dwr-m921 firmware. EPSS 3.4% chance of exploitation in the next 30 days.

A vulnerability has been found in D-Link DWR-M921 1.1.50. This impacts an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of the argument fota_url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-74
Published: 2026-02-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dlink:dwr-m921_firmware

References

https://github.com/LX-66-LX/cve-new/issues/3
https://vuldb.com/?ctiid.344871
https://vuldb.com/?id.344871
https://vuldb.com/?submit.748930
https://www.dlink.com/

Check your stack JSON