CVE-2026-90704

2.0 lowEPSS 2.3%

Low (2.0). EPSS 2.3% chance of exploitation in the next 30 days.

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

CVSS 3.1

6.6 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-77
Published: 2026-09-14
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/H3rmesk1t/2052767b9fb397e311c17383a0e19021
https://vuldb.com/cve/CVE-2026-90704
https://vuldb.com/submit/917696
https://vuldb.com/vuln/403246
https://vuldb.com/vuln/403246/cti

Check your stack JSON