The flaw resides in the sub_412DA0 function of the /boafrm/formIMEISetup page on D-Link DWR‑M920 routers. By manipulating the IMEI_value argument, an attacker can cause operating‑system command injection, allowing execution of arbitrary shell commands on the device. This can lead to full device compromise, denial of service, or use of the router as part of a larger malicious network. The weakness involves improper handling of external input and is catalogued as CWE‑77 and CWE‑78.

All D-Link DWR‑M920 routers running firmware version 1.1.50 or earlier are affected. Firmware updates introduced after 1.1.50 remove the vulnerable function, providing a path to remediation. Only the DWR‑M920 model is referenced; no other D-Link products have been reported to use the same vulnerable code.

The CVSS score of 5.3 indicates moderate severity, but the vulnerability is exploitable remotely without authentication, with a publicly available exploit published. The EPSS score is not available and the flaw is currently not listed in the CISA KEV catalog, though the presence of a ready-made exploit signals that attackers may target it. Given the remote nature of the attack and the potential to hijack the device, the risk to affected routers, especially those exposed to the Internet, is significant.