CVE-2026-11341 in DWR-M920

Summary

by MITRE • 06/05/2026

A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsible: VulDB
• Disclosure: 06/05/2026
• Moderation: accepted
• Entry: VDB-368882
• CPE: ready
• CWE: CWE-78 (confirmed)
• Exploit: Download
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-11341
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11341
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-11341/