PT-2026-47006 · D Link · Dwr-M920

Kkff33 · Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-11341

NVD

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub 412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-11341

Affected Products

Dwr-M920

References · 7

• 🔥 https://github.com/7u7777/Dlink/blob/DWR-M920/formIMEISetup.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11341 · Security Note
• https://vuldb.com/cve/CVE-2026-11341 · Note
• https://vuldb.com/vuln/368882/cti · Note
• https://vuldb.com/submit/832593 · Note
• https://vuldb.com/vuln/368882 · Note
• https://dlink.com · Note