The vulnerability resides in D‑Link DWR‑M921 firmware version 1.1.50, affecting the /boafrm/formLtefotaUpgradeFibocom endpoint. By manipulating the fota_url argument, an attacker can inject shell commands, potentially executing arbitrary code on the device. This type of command injection directly compromises the confidentiality, integrity, and availability of the network device.

Affected product is the D‑Link DWR‑M921 router running firmware 1.1.50. The flaw is limited to the formLtefotaUpgradeFibocom function within the router's web interface and does not affect other modules.

The CVSS score of 5.3 indicates a moderate risk level, and the EPSS score of less than 1% shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread known exploits. The attack vector is remote, likely exploiting the device's web interface; no local privilege or physical access is required. Because the injection can execute arbitrary commands, an attacker could take full control of the device, exfiltrate data, or render the device inoperable.