CVE-2026-90705

2.0 lowEPSS 2.3%

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

CVSS 3.1

6.6 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-09-14
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/H3rmesk1t/42bca7c81530b8419811ddcbd39b3b56
https://vuldb.com/cve/CVE-2026-90705
https://vuldb.com/submit/917697
https://vuldb.com/vuln/403247
https://vuldb.com/vuln/403247/cti

Check your stack JSON