CVE-2026-90704 in DWR-M921

Prediction

by VulDB Data Team • 09/13/2026

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsible: VulDB
• Moderation: accepted
• Entry: VDB-403246
• CPE: ready
• CWE: CWE-77 (confirmed)
• Exploit: Download
• CVSS: 6.6 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-90704
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90704
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-90704/