CVE-2026-11341 in DWR-M920
Summary
by MITRE • 06/05/2026
A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/09/2026
The vulnerability identified in D-Link DWR-M920 routers version 1.1.50 and earlier represents a critical command injection flaw that exposes the device to remote exploitation. This security weakness resides within the web interface component of the router firmware, specifically in the function sub_412DA0 located in the file /boafrm/formIMEISetup. The vulnerability stems from inadequate input validation and sanitization of the IMEI_value parameter, which is processed without proper escaping or filtering of special characters that could be interpreted as shell commands by the underlying operating system. The flaw allows an attacker to inject malicious operating system commands through the web interface, potentially gaining unauthorized access to the router's underlying system.
The technical implementation of this vulnerability demonstrates a classic command injection attack vector where user-supplied input flows directly into system execution contexts without proper sanitization. When the IMEI_value parameter is submitted through the web form, the application fails to properly escape or validate special shell metacharacters such as semicolons, ampersands, or backticks that could alter the intended command execution flow. This design flaw enables attackers to append arbitrary commands that execute with the privileges of the web server process, typically running with elevated system privileges. The vulnerability is particularly concerning as it operates within the context of the router's web management interface, making it accessible to remote attackers without requiring physical access or authentication to the device.
The operational impact of this vulnerability extends beyond simple command execution, potentially allowing attackers to gain complete control over the affected router. Successful exploitation could enable adversaries to modify router configuration settings, install malicious firmware, redirect network traffic, or establish persistent backdoors for future access. The remote exploitability of this vulnerability means that attackers can target these devices from anywhere on the internet, making them particularly attractive targets for large-scale automated attacks. The fact that exploits have been published and are readily available increases the risk of widespread compromise across networks utilizing affected D-Link DWR-M920 models. This vulnerability directly maps to CWE-77 and CWE-88 within the CWE database, representing command injection and improper neutralization of special elements used in OS commands, respectively. The attack pattern aligns with ATT&CK technique T1059.001 for command and scripting interpreter and T1021.001 for remote services, as the exploitation leverages the router's web interface to execute arbitrary commands remotely.
Organizations and individuals utilizing D-Link DWR-M920 routers should immediately implement mitigations to address this vulnerability. The primary recommended action is to upgrade to the latest firmware version released by D-Link, which should contain patches addressing the command injection flaw. Network administrators should also consider implementing firewall rules to restrict access to the router's web management interface from untrusted networks, and if possible, disable remote management features entirely. Additional protective measures include monitoring network traffic for suspicious command execution patterns and implementing intrusion detection systems that can identify attempts to exploit this vulnerability. The vulnerability demonstrates the importance of proper input validation and output encoding in web applications, particularly when dealing with user-supplied data that may be passed to system execution contexts. Organizations should also conduct comprehensive inventory assessments to identify all affected devices and implement patch management procedures to ensure timely remediation of similar vulnerabilities across their network infrastructure.