PT-2026-46838 · D Link · Dwr-M920

Kkff33 · Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-10878

Mitre

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub 41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument action value results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-10878

Affected Products

Dwr-M920

References · 7

• 🔥 https://github.com/7u7777/Dlink/blob/DWR-M920/formSmsManage.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10878 · Security Note
• https://vuldb.com/vuln/368368/cti · Note
• https://vuldb.com/vuln/368368 · Note
• https://vuldb.com/submit/832154 · Note
• https://vuldb.com/cve/CVE-2026-10878 · Note
• https://dlink.com · Note