Description
A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component USSD Configuration Endpoint. The manipulation of the argument ussdValue leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-02-07
Score: 8.6 High
EPSS: 4.4% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the D-Link DWR-M921 firmware 1.1.50 within the USSD Configuration Endpoint, specifically in the function sub_419F20 of the /boafrm/formUSSDSetup component. By manipulating the ussdValue argument, an attacker can inject arbitrary operating system commands, enabling full remote code execution on the device. The flaw is identified as a command injection (CWE‑74) and OS command injection (CWE‑77) weakness.

Affected Systems

This issue affects all D-Link DWR-M921 routers running firmware version 1.1.50. The vulnerable component is the USSD Configuration Endpoint exposed by the router, which may be accessed remotely.

Risk and Exploitability

This vulnerability has a CVSS score of 8.6, indicating high severity. It can be exploited remotely, and its EPSS score is 4%, indicating a moderate likelihood of exploitation at present. The flaw permits execution of arbitrary commands via the USSD configuration endpoint, which could compromise the device. Based on the description, it is inferred that a compromised device could serve as a foothold for further network activity, but the CVE description does not explicitly state lateral movement.

Generated by OpenCVE AI on June 18, 2026 at 11:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware upgrade that removes the vulnerable command injection code.
  • Configure firewall rules or ACLs to block external traffic to the USSD configuration endpoint, allowing only trusted internal hosts.
  • If a firmware upgrade is not available, disable the USSD functionality in the device settings or physically disconnect the port servicing the endpoint.
  • Consider isolating the router in a separate VLAN to limit potential lateral movement should the vulnerability be exploited.

Generated by OpenCVE AI on June 18, 2026 at 11:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 12 Feb 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dwr-m921
Dlink dwr-m921 Firmware
CPEs cpe:2.3:h:dlink:dwr-m921:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m921_firmware:1.1.50:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dwr-m921
Dlink dwr-m921 Firmware

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dwr-m921
Vendors & Products D-link
D-link dwr-m921

Sat, 07 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component USSD Configuration Endpoint. The manipulation of the argument ussdValue leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Title D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

D-link Dwr-m921
Dlink Dwr-m921 Dwr-m921 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:32:00.509Z

Reserved: 2026-02-06T08:20:31.394Z

Link: CVE-2026-2085

cve-icon Vulnrichment

Updated: 2026-02-10T15:45:37.887Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-07T12:15:56.723

Modified: 2026-06-17T10:30:17.123

Link: CVE-2026-2085

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T11:15:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')