An attacker can send a specially crafted firmware URL to the sub_419920 function in the /boafrm/formLtefotaUpgradeQuectel endpoint, causing an uncontrolled command to be executed on the device. This command injection flaw allows the execution of arbitrary shell commands, potentially granting full control over the router and compromising its stored data as well as any services it hosts.

The vulnerability affects D-Link DWR‑M921 routers running firmware version 1.1.50. Only devices with this exact firmware build are known to be vulnerable; other firmware revisions or products are not listed as affected.

The CVSS score of 5.3 indicates a medium severity level. The EPSS score of less than 1% suggests a very low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. Nevertheless, the exploit is publicly available and can be launched remotely, typically through the router’s network management interface or a remote firmware update request. Given the remote nature of the attack and lack of user interaction requirements, the risk depends on the network exposure of the target device.