CVE-2026-2169

D-Link DWR-M921 formLtefotaUpgradeFibocom command injection

View on CVE.org
Published Feb 8, 2026 CVSS 4.0 · 5.3 Medium EPSS 3.4% KEV · Not listed
Description
A vulnerability has been found in D-Link DWR-M921 1.1.50. This impacts an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of the argument fota_url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Analysis

AI-generated

Technical impact

The vulnerability resides in D‑Link DWR‑M921 firmware version 1.1.50, affecting the /boafrm/formLtefotaUpgradeFibocom endpoint. By manipulating the fota_url argument, an attacker can inject shell commands, potentially executing arbitrary code on the device. This type of command injection directly compromises the confidentiality, integrity, and availability of the network device.

Affected Systems

Affected product is the D‑Link DWR‑M921 router running firmware 1.1.50. The flaw is limited to the formLtefotaUpgradeFibocom function within the router's web interface and does not affect other modules.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk level, and the EPSS score of 0.02607% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread known exploits. The attack vector is remote, likely exploiting the device's web interface; no local privilege or physical access is required. Because the injection can execute arbitrary commands, an attacker could take full control of the device, exfiltrate data, or render the device inoperable.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router to the latest firmware revision that incorporates input validation and sanitization to mitigate CWE‑74 and CWE‑77 command injection flaws.
  • Enforce strict input validation on the fota_url parameter, ensuring that only expected characters and formats are accepted; reject or escape shell special characters in accordance with CWE‑74 guidelines.
  • If a firmware update is unavailable, restrict remote access to the web interface, block the /boafrm/formLtefotaUpgradeFibocom endpoint from unauthenticated or untrusted IP addresses, and monitor logs for suspicious command execution attempts.

Generated by OpenCVE AI on June 18, 2026 at 11:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Dlink
Dlink dwr-m921
Dlink dwr-m921 Firmware
CPEs cpe:2.3:h:dlink:dwr-m921:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m921_firmware:1.1.50:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dwr-m921
Dlink dwr-m921 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared D-link
D-link dwr-m921
Vendors & Products D-link
D-link dwr-m921
Type Values Removed Values Added
Description A vulnerability has been found in D-Link DWR-M921 1.1.50. This impacts an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of the argument fota_url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Title D-Link DWR-M921 formLtefotaUpgradeFibocom command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Feb 23, 2026, 9:45 AM
Reserved
Feb 7, 2026, 10:35 AM

View source JSON

Updated
Feb 9, 2026, 6:54 PM

JSON

Status
Analyzed
Published
Feb 8, 2026, 6:15 PM
Modified
Jun 17, 2026, 10:30 AM

View source JSON

No data.

Updated
Jun 18, 2026, 11:15 AM

JSON