PT-2026-46978 · D Link · Dwr-M920

Kkff33 · Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-11339

NVD

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub 41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-11339

Affected Products

Dwr-M920

References · 7

• 🔥 https://github.com/7u7777/Dlink/blob/DWR-M920/formUSSDSetup.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11339 · Security Note
• https://vuldb.com/vuln/368881/cti · Note
• https://dlink.com · Note
• https://vuldb.com/cve/CVE-2026-11339 · Note
• https://vuldb.com/submit/832579 · Note
• https://vuldb.com/vuln/368881 · Note